sessionmanager | 40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3

General

Target
40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
Size 183KB
Sample240410-mlys8sff2t
SHA256 40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
MD5 4ee3fb2aba3b82171e6409e253bdddb5
SHA1 f5112f83885f2ede5d648224f18d78c5e70b9493
SHA512 9a1c134c906eb85b6802edba37074cae7b5057d15f368937c075920b001ed1491004c1b021ba0bdf8e01d13398d96ae68f5b9968d4a7bc2614d9b83a758ac6e4
SSDEEP 3072:P9031LWaYenq+cAljU4edllrXsYsT4iK9JG1yy59thOpQc:161LOenq+cSoJXCThK12
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor sessionmanager

Malware Config

Signatures

Detected SessionManager backdoor 1 IoCs

backdoor

resource	yara_rule
sample	family_sessionmanager

Sessionmanager family
sessionmanager

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3

File Explorer

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3

.dll 183KB

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3

IMPHASH 260f062f465927f119471606799533ea
SHA256 40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
MD5 4ee3fb2aba3b82171e6409e253bdddb5
SHA1 f5112f83885f2ede5d648224f18d78c5e70b9493
SHA512 9a1c134c906eb85b6802edba37074cae7b5057d15f368937c075920b001ed1491004c1b021ba0bdf8e01d13398d96ae68f5b9968d4a7bc2614d9b83a758ac6e4
SSDEEP 3072:P9031LWaYenq+cAljU4edllrXsYsT4iK9JG1yy59thOpQc:161LOenq+cSoJXCThK12
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detected SessionManager backdoor

backdoor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

32120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\GodLike\Desktop\t\t4\SessionManagerV2Module\x64\Release\sessionmanagermodule.pdb

kernel32

OutputDebugStringA DebugBreak ReadFile CreatePipe GetLastError CloseHandle CreateProcessA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CreateFileW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle FlushFileBuffers WriteFile GetConsoleCP DeleteFileW GetCurrentDirectoryW GetFullPathNameW CompareStringW LCMapStringW SetStdHandle GetStringTypeW GetACP FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap WriteConsoleW GetTimeZoneInformation HeapSize HeapReAlloc SetEndOfFile

Name

.text

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3

kernel32

generic