Behavioral task
behavioral1
Sample
1368-55-0x00000000021F0000-0x0000000002662000-memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1368-55-0x00000000021F0000-0x0000000002662000-memory.dll
Resource
win10v2004-20240226-en
General
-
Target
1368-55-0x00000000021F0000-0x0000000002662000-memory.dmp
-
Size
4.4MB
-
MD5
d35a711d0bc3b93f6eebbc34e82f4f3d
-
SHA1
26ec3637ab284fe6067bfe2e1cb1a8b1f8b2611c
-
SHA256
64ac0d65099b2570bbd505d17e3ef5d0512df7b617064924416bcf1a2d29a1b1
-
SHA512
bd73a1f422dbbf955129055af721c3c766a33a75376fc87ecad3df4e59f5508dfdab7e49b305fcc2adda35b3369d7927f3cb3ad6e149278c39c2330244359359
-
SSDEEP
3072:eNhWKHXsrtEaLjXIuTvYdJN5yFxTWzHV5/E3t34XPPNLYJNzeITisOe0Augq:eNhWBXXI2YdYTW7s3qXtLsTiLAu
Malware Config
Extracted
cobaltstrike
0
-
watermark
0
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1368-55-0x00000000021F0000-0x0000000002662000-memory.dmp
Files
-
1368-55-0x00000000021F0000-0x0000000002662000-memory.dmp.dll windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ