107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a

Sharing

Copy URL Twitter E-mail

Reason

config extraction: CfgExtr crashed: 'CobaltStrike64' runtime error: invalid memory address or nil pointer dereference

General

Target

107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a
Size

366KB
MD5

ef25026e56b89fcad235facd7884ea7f
SHA1

34173b24c1f78ec7d20f721d521e892c30b4e6f3
SHA256

107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a
SHA512

38c3f8eb7daf777c7df29e2d15b5bb02e37b4f148925398622a4cd31440235a1a7785683e3f39a745383be368e447be87686c6e823eba15e0f996524716381de
SSDEEP

3072:fQE0GNP7Li40LFiq1TFfyihUlFKxHWde2Is77Upv/dxhQfmaw9rLcAYVoe431cQ:Imnx0LFJ1Bz1HSIJz1DYVoeYc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a

Files

107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a
.exe windows:6 windows x64 arch:x64

14556e6f2d494bd46d0318b274f68c1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetTickCount64
GetLogicalDrives
CreateFileW
GetCurrentProcessId
ReadProcessMemory
VirtualQueryEx
GetProcessIoCounters
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
GetSystemTimes
GetProcessTimes
HeapAlloc
ReleaseMutex
HeapFree
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
QueryPerformanceCounter
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetProcessHeap
GetSystemInfo
GetDiskFreeSpaceExW
GetLastError
GetCurrentThreadId
InitializeSListHead
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RtlVirtualUnwind
IsDebuggerPresent
GetStdHandle
UnhandledExceptionFilter
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
SetUnhandledExceptionFilter
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
CloseHandle
CreateRemoteThread
WriteProcessMemory
GetConsoleMode
LocalFree
GlobalMemoryStatusEx
VirtualAllocEx
GetModuleHandleW
FormatMessageW
OpenProcess
MultiByteToWideChar
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
IsProcessorFeaturePresent

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhCloseQuery
PdhOpenQueryA
PdhAddEnglishCounterW
PdhRemoveCounter

powrprof

CallNtPowerInformation

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

advapi32

SystemFunction036
GetTokenInformation
OpenProcessToken
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid

ntdll

RtlGetVersion
RtlNtStatusToDosError
NtQuerySystemInformation
NtWriteFile
NtQueryInformationProcess

psapi

GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

iphlpapi

GetAdaptersAddresses
GetIfTable2
FreeMibTable
GetIfEntry2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserGetInfo
NetUserEnum

secur32

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

bcrypt

BCryptGenRandom

vcruntime140

memmove
__current_exception_context
__CxxFrameHandler3
memcmp
memcpy
memset
_CxxThrowException
__C_specific_handler
__current_exception

api-ms-win-crt-heap-l1-1-0

free
realloc
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_set_app_type
__p___argc
__p___argv
_seh_filter_exe
_register_onexit_function
_cexit
_c_exit
_crt_atexit
_initialize_narrow_environment
_initialize_onexit_table
_get_initial_narrow_environment
_exit
_initterm
_initterm_e
exit
_configure_narrow_argv
terminate
_register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

14556e6f2d494bd46d0318b274f68c1c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

powrprof

ole32

oleaut32

advapi32

ntdll

psapi

shell32

iphlpapi

netapi32

secur32

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 260KB - Virtual size: 259KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 512B - Virtual size: 952B

.pdata Size: 15KB - Virtual size: 14KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 260KB - Virtual size: 259KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 512B - Virtual size: 952B

.pdata
Size: 15KB - Virtual size: 14KB

.reloc
Size: 1KB - Virtual size: 1KB