Static task
static1
Behavioral task
behavioral1
Sample
cs2-dumper.exe
Resource
win10-20231020-en
General
-
Target
cs2-dumper.exe
-
Size
2.7MB
-
MD5
1ef4db9ed736b192f7f66b71d2e88728
-
SHA1
5a04773567664867e89acc46a06e08d84724d53c
-
SHA256
5d63ece1a1dd18369425cb95229255a690e00ed0ad1a25729556f331a254e51a
-
SHA512
178acbbb02dbe7184b23ba8e661374ddbb2c44170d07e56499ee45105cdbdfa7ed0c3ee6eee3eeedda84b4d5f05aeabb9b42220d89ac014b60d3e4da5cb91fbe
-
SSDEEP
49152:/VFq5/jXPJY9fHPEPz+6ffyncIUFfg0R+S9tuQoLf4Rnsb:uRUEPzFIr8tuQoLf4Rn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cs2-dumper.exe
Files
-
cs2-dumper.exe.exe windows:6 windows x64 arch:x64
62efb6bfb0d2282dededaf39607a0357
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
QueryPerformanceCounter
GetCommandLineW
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetCurrentThreadId
SetConsoleMode
GetConsoleMode
GetStdHandle
GetCurrentProcessId
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
AcquireSRWLockShared
QueryPerformanceFrequency
ReleaseSRWLockShared
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
AcquireSRWLockExclusive
CreateDirectoryW
FindFirstFileW
GetFileType
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
FormatMessageW
InitializeSListHead
MultiByteToWideChar
WriteConsoleW
GetSystemTimeAsFileTime
RtlVirtualUnwind
IsDebuggerPresent
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
GetProcessHeap
HeapFree
CloseHandle
Module32Next
Module32First
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
ReadProcessMemory
IsProcessorFeaturePresent
oleaut32
SysStringLen
GetErrorInfo
SysFreeString
advapi32
SystemFunction036
ntdll
RtlNtStatusToDosError
NtReadFile
NtWriteFile
bcrypt
BCryptGenRandom
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memset
memcmp
memcpy
memmove
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_get_initial_narrow_environment
exit
_initialize_narrow_environment
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_set_app_type
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_exit
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 862KB - Virtual size: 862KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ