Behavioral task
behavioral1
Sample
f7714a6adf58a4ff4d44be68e5bbd676c860f3560cf20b821051d0948c491bfa.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f7714a6adf58a4ff4d44be68e5bbd676c860f3560cf20b821051d0948c491bfa.dll
Resource
win10v2004-20230703-en
General
-
Target
f7714a6adf58a4ff4d44be68e5bbd676c860f3560cf20b821051d0948c491bfa
-
Size
9KB
-
MD5
92fe208986491f8510883bbff5391bc3
-
SHA1
386fc5e8af6fd706876320a933149467303ca8e2
-
SHA256
f7714a6adf58a4ff4d44be68e5bbd676c860f3560cf20b821051d0948c491bfa
-
SHA512
cbd7f47f81576d231011c0b62e5cce32e83dd95154fd30530e9d44211f6a4dc34cff0ccfbfb59026653f72bb90fcf56fc7c731179241a63a9990d930afca0424
-
SSDEEP
48:q0r+l6O5aXyn/hNhx4/jC/VyR9x3P7cvAw5av9w/nuPLLCKRb0E:dX0Y7x34r5av2nELLP
Malware Config
Extracted
cobaltstrike
http://43.138.188.41:5556/ZLBu
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; .NET CLR 2.0.50727)
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f7714a6adf58a4ff4d44be68e5bbd676c860f3560cf20b821051d0948c491bfa
Files
-
f7714a6adf58a4ff4d44be68e5bbd676c860f3560cf20b821051d0948c491bfa.dll windows x64
57d6e7112c8e716cfe2eb0ff9f36763c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
ReleaseSemaphore
WaitForSingleObject
CreateEventA
OpenEventA
ExitThread
ResumeThread
CreateProcessA
GetThreadContext
SetThreadContext
VirtualAllocEx
WriteProcessMemory
CreateSemaphoreA
Sections
.text Size: 1024B - Virtual size: 919B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ