Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_3766aed674b1e99025ab586a5d44fb18_cobalt-strike_mamba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_3766aed674b1e99025ab586a5d44fb18_cobalt-strike_mamba.exe
Resource
win10v2004-20240221-en
Target
2024-02-23_3766aed674b1e99025ab586a5d44fb18_cobalt-strike_mamba
Size
336KB
MD5
3766aed674b1e99025ab586a5d44fb18
SHA1
d203dc0d6b9d76408798689daeabea8aec552cc3
SHA256
f251df37e63b1ff8b3dd12885e8e1e232143741523b5147b7d960d3fcbe6dd8b
SHA512
38620d0f5c9e75d367308c7859ba5f662a6938b53ee11b34fadc02fba0c4f4c5096d4a2e0dcdec41f38e2f1b5d075082ac898eb69f77a34e1801727b1af57f1c
SSDEEP
6144:giBNdPTUAYhEpDLjXi6X+Dn0lRFQOtN2yUooX2nfurA:giBDANhynig+L0lRxw/oAab
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\a\DiskCryptor\DiskCryptor\DCrypt\Bin\Release_amd64\dcrypt.pdb
ImageList_Add
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Create
ord17
ImageList_Draw
PathFileExistsW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
NtQueryInformationProcess
GetFileSize
ExitProcess
DeleteVolumeMountPointW
GetCurrentThreadId
SetThreadPriority
SuspendThread
ResumeThread
GetLastError
CreateThread
FileTimeToSystemTime
GetSystemTimeAsFileTime
SizeofResource
WriteFile
FormatMessageW
LockResource
LoadResource
FindResourceW
LocalFree
FindNextFileW
FindClose
LoadLibraryW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
GetStdHandle
RaiseException
EncodePointer
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
InitializeCriticalSection
GetVolumeInformationW
SetVolumeMountPointW
CreateFileW
LeaveCriticalSection
EnterCriticalSection
ReadFile
GetLogicalDrives
CreateProcessW
CloseHandle
GlobalFindAtomW
Sleep
OpenProcess
WaitForSingleObject
GetModuleFileNameW
GetCurrentProcess
WriteConsoleW
GetProcessHeap
GetEnvironmentStringsW
GetDialogBaseUnits
DrawTextExW
DrawEdge
ExitWindowsEx
DestroyWindow
GetClassNameW
UnhookWindowsHookEx
DrawFocusRect
SetWindowsHookExW
GetFocus
SetMenuItemInfoW
LoadCursorW
LoadBitmapW
MapDialogRect
GetKeyState
DrawStateW
CallNextHookEx
FillRect
EnumChildWindows
InvalidateRect
GetParent
GetClientRect
MoveWindow
GetWindowInfo
ShowWindow
GetSystemMetrics
SendMessageW
ScreenToClient
SetWindowPos
GetWindowRect
GetWindowLongW
EnableWindow
EnableMenuItem
GetDlgItem
GetSysColor
GetMenu
GetWindowTextW
DialogBoxParamW
IsWindowEnabled
SetWindowTextW
GetMenuItemCount
MessageBoxW
RegisterHotKey
UnregisterHotKey
SetForegroundWindow
KillTimer
FindWindowW
LoadIconW
TranslateMessage
TranslateAcceleratorW
RegisterClassW
DestroyAcceleratorTable
DefDlgProcW
SetTimer
DispatchMessageW
LoadAcceleratorsW
CreateDialogParamW
GetMessageW
ReleaseDC
LookupIconIdFromDirectoryEx
SetCursor
SetFocus
TrackMouseEvent
DestroyIcon
GetWindowLongPtrW
EndDialog
SetWindowLongPtrW
IsWindowVisible
GetDC
CreateIconFromResourceEx
CallWindowProcW
AppendMenuW
DestroyMenu
SetWindowTextA
GetWindowTextA
TrackPopupMenu
CreatePopupMenu
GetMessagePos
GetNextDlgTabItem
GetCursorPos
PostQuitMessage
CreateFontIndirectW
GetTextMetricsW
SetTextColor
SelectObject
GetTextExtentPoint32W
GetStockObject
SetDCBrushColor
ExtTextOutW
SetBkColor
SetBkMode
GetOpenFileNameW
GetSaveFileNameW
RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyW
RegSetValueExW
RegQueryValueExW
SHGetPathFromIDListW
Shell_NotifyIconW
ShellExecuteW
SHBrowseForFolderW
dc_has_pending_header
rnd_reseed_now
dc_get_bsod
dc_save_config
dc_is_dcs_on_partition
load_file
dc_start_re_encrypt
is_w10_reflect_supported
dc_start_encrypt
update_w10_reflect_driver
dc_prep_encrypt
dc_is_device_ssd
dc_start_format
dc_get_device_status
dc_get_status_str
enable_privilege
dc_dec_step
dc_sync_enc_state
dc_enc_step
dc_format_step
dc_disk_close
dc_disk_open
dc_encrypt_iso_image
secure_alloc
dc_add_keyfiles
dc_is_old_runned
dc_is_driver_works
is_admin
dc_efi_init
dc_get_version
rnd_init
dc_load_config
dc_install_driver
dc_efi_check
dc_remove_driver
dc_is_driver_installed
dc_open_device
dc_update_driver
dc_get_hw_name
dc_first_volume
dc_next_volume
dc_start_encrypt2
dc_format_fs
dc_unmount_volume
dc_start_decrypt
dc_efi_is_msft_on_disk
dc_device_control
save_file
dc_set_boot
dc_backup_header
dc_get_cipher_name
dc_make_iso
dc_benchmark
dc_change_password
dc_set_efi_boot
dc_unset_efi_boot
dc_restore_header
dc_done_format
dc_update_boot
dc_efi_is_bme_set
dc_mount_volume
dc_make_pxe
dc_set_mbr_config
dc_mount_all
dc_is_dcs_on_disk
dc_unset_mbr
secure_free
dc_get_mbr_config
dc_set_mbr
dc_update_efi_boot
dc_mk_efi_rec
dc_efi_set_bme
dc_get_pending_header_nt
dc_efi_is_secureboot
dc_efi_shim_available
dc_efi_del_bme
dc_unmount_all
dc_get_drive_info
dc_mbr_config_by_partition
dc_efi_config_by_partition
dc_is_gpt_disk
dc_get_boot_device
dc_efi_config
dc_get_boot_disk
dc_dsk_get_size
dc_has_dc_mbr
dc_format_byte_size
is_win_vista
dc_clear_pending_header
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ