cslol-manager[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cslol-manager.exe
Size

26.7MB
MD5

5a6b72fa404f3b895df10b7818f2b77e
SHA1

ea83d8c8222e7ec7aac2ec30d7e40adcd8af08d4
SHA256

f7960bb2203ce060883fc27f78ec883c8d82e34523e077e228b3dd6e22003ad7
SHA512

954cc739e1a53186ebbe94c7341fdc949ff9bcc467167a9ff6f7c0f67abe8b0274abed04899d4c5e6b0aed18ee0becdbbf1d3193c568f2174b27cab9b1ec3289
SSDEEP

393216:329fJB5rHY6ZZOPVsup5gAXKA5U+xG7QJsv6tWKFdu9CpH10I:3KfJBbZuV67a10

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cslol-manager.exe

Files

cslol-manager.exe
.exe windows:6 windows x64

235ca61f02b01c57a9a85b6d15bf071c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GlobalSize
GetCurrentProcessId
GetUserDefaultLangID
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
lstrcmpW
DisconnectNamedPipe
WaitNamedPipeW
LoadLibraryW
WaitForMultipleObjects
GlobalFree
SetHandleInformation
CompareStringEx
GetCommandLineW
DuplicateHandle
SetEvent
Sleep
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
OutputDebugStringW
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
GetSystemTime
GetLocalTime
ResetEvent
GetSystemDirectoryW
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetModuleHandleW
GetUserPreferredUILanguages
GetFileAttributesExW
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
GetStartupInfoW
GetModuleFileNameW
FlushFileBuffers
GetExitCodeProcess
FreeLibrary
GetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
ConnectNamedPipe
CreateNamedPipeW
UnregisterWaitEx
RegisterWaitForSingleObject
GetFileType
SetEndOfFile
SetFilePointerEx
FindFirstFileExW
LoadLibraryA
MultiByteToWideChar
GetModuleHandleExW
CompareStringW
LCMapStringW
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetGeoInfoW
GetUserGeoID
ExitProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateMutexW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
RtlPcToFileHeader
RaiseException
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
SetLastError
RtlUnwind
LoadLibraryExW
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFileAttributesW
SetStdHandle
HeapFree
HeapAlloc
HeapReAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
SetEnvironmentVariableW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
GetCurrentThreadId
WideCharToMultiByte
WriteFile
SetFilePointer
GetFileSizeEx
GetProcAddress
FormatMessageW
LocalFree
LocalAlloc
CreateEventW
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ReadFile
CreateFileW
GetLastError
RtlDeleteFunctionTable
RtlAddFunctionTable
GetSystemInfo
VirtualFree
VirtualProtect
VirtualAlloc
GetTimeZoneInformation
GetConsoleWindow
GetLocaleInfoW
GlobalLock
GlobalUnlock
GlobalAlloc
CheckRemoteDebuggerPresent
CloseHandle
CreateProcessW
ExpandEnvironmentStringsW
FindNextFileW
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryFullProcessImageNameW
OpenProcess
GetUserDefaultLCID

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

netapi32

NetApiBufferFree
NetShareEnum

ws2_32

WSAGetLastError
setsockopt
WSANtohs
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSAConnect
gethostname
WSAStartup
WSACleanup
WSAAsyncSelect
getsockname
WSAHtonl
WSANtohl
WSAIoctl
WSAAccept
htonl
ntohl
WSASocketW
getaddrinfo
freeaddrinfo
getnameinfo
getsockopt
__WSAFDIsSet
bind
htons
closesocket
select
listen
getpeername

advapi32

RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask
GetLengthSid
FreeSid
DuplicateToken
CopySid
AllocateAndInitializeSid
AccessCheck
OpenProcessToken
SystemFunction036
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey

ole32

OleGetClipboard
CoGetMalloc
ReleaseStgMedium
CoTaskMemFree
DoDragDrop
CoCreateInstance
OleIsCurrentClipboard
StringFromGUID2
CoCreateGuid
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
CoUninitialize
CoInitializeEx
CoInitialize
OleSetClipboard
OleFlushClipboard

shell32

SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHParseDisplayName
SHGetMalloc
SHGetKnownFolderIDList
Shell_NotifyIconW
Shell_NotifyIconGetRect
CommandLineToArgvW
SHGetKnownFolderPath
ord155
SHGetPathFromIDListW
SHBrowseForFolderW

user32

GetWindowRect
AdjustWindowRectEx
SetCursor
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SetParent
GetWindowThreadProcessId
GetWindow
DestroyCursor
DestroyIcon
MonitorFromPoint
GetAncestor
GetKeyboardLayoutList
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
UnregisterClassW
GetClassInfoW
RegisterClassExW
GetFocus
GetCursorPos
WindowFromPoint
ChildWindowFromPointEx
GetSysColorBrush
LoadImageW
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
GetSysColor
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatW
SetWindowTextW
RegisterWindowMessageW
IsWindowEnabled
CreateCaret
DestroyCaret
HideCaret
ShowCaret
SetCaretPos
FindWindowA
PeekMessageW
IsZoomed
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
TrackPopupMenuEx
SetCursorPos
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
RegisterClassW
EnumDisplayDevicesW
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetTouchInputInfo
CloseTouchInputHandle
GetWindowTextW
EnumWindows
RealGetWindowClassW
ChangeWindowMessageFilterEx
TranslateMessage
DispatchMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
PostThreadMessageW
CharNextExA
RegisterDeviceNotificationW
UnregisterDeviceNotification
DrawIconEx
InvalidateRect
SetWindowRgn
GetUpdateRect
EndPaint
GetClientRect
BeginPaint
ReleaseDC
MessageBeep
GetDC
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMenu
GetMenu
IsWindow
GetDoubleClickTime
SystemParametersInfoW
MessageBoxW
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
IsTouchWindow
UnregisterTouchWindow
RegisterTouchWindow
SetFocus
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsChild
CreateWindowExW
DefWindowProcW
AttachThreadInput
PostMessageW
SendMessageW
UpdateLayeredWindowIndirect
GetDesktopWindow
GetCaretBlinkTime
GetKeyboardLayout

winmm

timeKillEvent
timeSetEvent
PlaySoundW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1
CreateDXGIFactory2

oleaut32

SysFreeString
SafeArrayPutElement
SafeArrayCreateVector
SysAllocString

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmGetVirtualKey
ImmAssociateContextEx
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
ImmGetDefaultIMEWnd

opengl32

glLoadIdentity
glLoadMatrixf
glMatrixMode
glOrtho

gdi32

CreateDIBSection
GetTextFaceW
GetTextMetricsW
BitBlt
GdiFlush
GetBitmapBits
GetDIBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
CombineRgn
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetRegionData
SetPixelFormat
SwapBuffers
CreateRectRgn
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
GetCharABCWidthsI
DeleteObject
OffsetRgn
SelectClipRgn
SetLayout
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
CreateBitmap
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
RemoveFontMemResourceEx

uxtheme

GetThemeInt
GetThemeColor
GetThemePartSize
GetThemeBool
GetCurrentThemeName
IsAppThemed
IsThemeActive
SetWindowTheme
GetThemeEnumValue
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundRegion
ord47
CloseThemeData
GetThemeTransitionDuration
GetThemePropertyOrigin
GetThemeMargins
OpenThemeData

dwmapi

DwmGetWindowAttribute
DwmIsCompositionEnabled
DwmSetWindowAttribute
DwmEnableBlurBehindWindow

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

iphlpapi

ConvertInterfaceNameToLuidW
GetAdaptersAddresses
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToGuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToIndex

secur32

ApplyControlToken
DeleteSecurityContext
FreeContextBuffer
QueryContextAttributesW
DecryptMessage
AcceptSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
EncryptMessage
AcquireCredentialsHandleW

crypt32

CertOpenSystemStoreW
CertDuplicateCertificateContext
CertOpenStore
PFXImportCertStore
CertFindChainInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertVerifyTimeValidity
CertAddStoreToCollection
CertFindCertificateInStore
CertCloseStore

bcrypt

BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

d3d12

ord102
D3D12SerializeRootSignature
ord101

d3dcompiler_47

D3DReflect
D3DCompile

dcomp

DCompositionCreateDevice

Exports

Exports

qt_qmlDebugClearBuffer
qt_qmlDebugConnectionBlocker
qt_qmlDebugConnectorOpen
qt_qmlDebugDisableService
qt_qmlDebugEnableService
qt_qmlDebugMessageAvailable
qt_qmlDebugMessageBuffer
qt_qmlDebugMessageLength
qt_qmlDebugObjectAvailable
qt_qmlDebugSendDataToService
qt_qmlDebugSetStreamVersion

Sections

.text
Size: 16.7MB - Virtual size: 16.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 943KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 860KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

235ca61f02b01c57a9a85b6d15bf071c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

userenv

version

netapi32

ws2_32

advapi32

ole32

shell32

user32

winmm

d3d11

dxgi

oleaut32

imm32

opengl32

gdi32

uxtheme

dwmapi

wtsapi32

iphlpapi

secur32

crypt32

bcrypt

d3d12

d3dcompiler_47

dcomp

Exports

Exports

Sections

.text Size: 16.7MB - Virtual size: 16.7MB

.rdata Size: 7.6MB - Virtual size: 7.6MB

.data Size: 943KB - Virtual size: 1.0MB

.pdata Size: 860KB - Virtual size: 860KB

.qtmetad Size: 5KB - Virtual size: 5KB

.qtmimed Size: 315KB - Virtual size: 315KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 176KB - Virtual size: 176KB

.reloc Size: 134KB - Virtual size: 133KB

.text
Size: 16.7MB - Virtual size: 16.7MB

.rdata
Size: 7.6MB - Virtual size: 7.6MB

.data
Size: 943KB - Virtual size: 1.0MB

.pdata
Size: 860KB - Virtual size: 860KB

.qtmetad
Size: 5KB - Virtual size: 5KB

.qtmimed
Size: 315KB - Virtual size: 315KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 176KB - Virtual size: 176KB

.reloc
Size: 134KB - Virtual size: 133KB