Behavioral task
behavioral1
Sample
2092-18-0x0000000003740000-0x000000000377E000-memory.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2092-18-0x0000000003740000-0x000000000377E000-memory.dll
Resource
win10v2004-20230915-en
General
-
Target
2092-18-0x0000000003740000-0x000000000377E000-memory.dmp
-
Size
248KB
-
MD5
844d41a946ede770071fe75f42b14f48
-
SHA1
3444e270134ac4a95b30ec68c149c1217fd4f43d
-
SHA256
2d0a25d30ffe4d215e1b4ef6bea38ffb9a755503b86906c03bb37450ab9f0b89
-
SHA512
9519054b80f02022bb225e4695eae15a250bdc43d104f73a925a50a6f9d65a2380437e1ba510ffc90f76dd29ae81828c3c073a86abf88aedbbd826a2373aec06
-
SSDEEP
3072:arjm9Z4rfIcZxU8CD7keMAU8YMvhQEFjNhb1jTAKA7jZUdKY5Dwh:arTfIO28CvkbAU8YMvhl1jT3A7je+h
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2092-18-0x0000000003740000-0x000000000377E000-memory.dmp
Files
-
2092-18-0x0000000003740000-0x000000000377E000-memory.dmp.dll windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ