C:\Users\nick2\Desktop\celex-byfron\x64\Release\celex-byfron.pdb
Behavioral task
behavioral1
Sample
celex/celex.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
celex/celex.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
celex/celex.exe
Resource
win7-20240221-en
General
-
Target
celex.zip
-
Size
644KB
-
MD5
ba9b26dd146c97220dd13770bb29ecf0
-
SHA1
da0694215423d103512f45856fccc742e48951f2
-
SHA256
bd1077abb660d881bcd6d67997500ba2711898dd32c65d110d433876f42c7562
-
SHA512
3e7f75ae38e388374ccd2dd251a5c5443ebf90cf34dcd49580f5532d89e8315106c17f4de79298eb2983a36aed35f186d23aad434c113a029ca1381295e13039
-
SSDEEP
12288:U0pT6kb1AvPO+U3KpUOUT6eLCaj1Sz0bTIQ+ceZiSl+XQS8r:U6T6kbsGK67T6eLBGlcegm+gS4
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1157539550202175508/bMQmprnNW_YWr8QpVQ5zMXdWzlm3rfBo94XzDEmBz73xfPgW9fNPx7PlsrG8XSq9bHed
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/celex/celex.exe family_umbral -
Umbral family
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/celex/celex.dll unpack001/celex/celex.exe
Files
-
celex.zip.zip
-
celex/celex.dll.dll windows:6 windows x64 arch:x64
6e7e5d381cc623ce5195a0e19e7a699b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
normaliz
IdnToAscii
ws2_32
closesocket
WSAResetEvent
WSAGetLastError
ntohs
WSASetLastError
WSAEventSelect
WSAEnumNetworkEvents
WSAStartup
WSACleanup
setsockopt
WSAIoctl
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
WSACreateEvent
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
WSACloseEvent
sendto
getpeername
ioctlsocket
gethostname
WSAWaitForMultipleEvents
send
getsockopt
htons
wldap32
ord50
ord41
ord46
ord217
ord143
ord26
ord27
ord211
ord33
ord35
ord79
ord30
ord200
ord301
ord22
ord45
ord32
ord60
crypt32
CryptDecodeObjectEx
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
IsValidSid
OpenProcessToken
GetLengthSid
GetTokenInformation
kernel32
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
RtlVirtualUnwind
CreateEventW
GetModuleHandleW
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
GetLocaleInfoEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
OutputDebugStringW
RtlLookupFunctionEntry
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
GetLastError
CloseHandle
GetCurrentProcessId
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
Sleep
CreateFileA
VirtualProtect
GetProcessId
CreateToolhelp32Snapshot
QueryFullProcessImageNameA
Module32FirstW
GetFileSizeEx
Module32NextW
IsWow64Process
VirtualQueryEx
GetCurrentProcess
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
FormatMessageW
GetTickCount
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
WaitForMultipleObjects
SleepEx
VerifyVersionInfoW
ReadProcessMemory
user32
MessageBoxA
GetAsyncKeyState
CallWindowProcA
DefWindowProcA
CreateWindowExA
SetWindowLongPtrA
RegisterClassExA
FindWindowA
SendInput
GetKeyState
LoadCursorA
GetDC
MonitorFromWindow
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
gdi32
GetDeviceCaps
shell32
SHGetKnownFolderPath
msvcp140
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exceptions@std@@YAHXZ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??Bios_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Xtime_get_ticks
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
memcmp
memmove
memchr
strrchr
__current_exception_context
memcpy
_CxxThrowException
__C_specific_handler
__std_exception_copy
__std_exception_destroy
strchr
memset
__std_type_info_destroy_list
strstr
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
_lseeki64
fgets
fputs
fgetc
_close
fputc
_write
_read
__stdio_common_vfprintf
feof
_open
fopen
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
ftell
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
fflush
fclose
fseek
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_callnewh
calloc
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_beginthreadex
_resetstkoflw
exit
_register_onexit_function
_initialize_narrow_environment
_invalid_parameter_noinfo
system
_errno
_initialize_onexit_table
_seh_filter_dll
_configure_narrow_argv
terminate
__sys_nerr
__sys_errlist
_execute_onexit_table
api-ms-win-crt-time-l1-1-0
_time64
strftime
_gmtime64
api-ms-win-crt-utility-l1-1-0
rand
qsort
srand
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
strncmp
strpbrk
tolower
strspn
strcspn
_strdup
api-ms-win-crt-convert-l1-1-0
strtod
wcstombs
atof
strtol
strtoul
atoi
strtoull
strtoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
sinf
fmodf
cosf
ceilf
acosf
_dclass
sqrtf
_fdopen
api-ms-win-crt-filesystem-l1-1-0
_unlink
_fstat64
_stat64
_unlock_file
_lock_file
_access
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
Sections
.text Size: 858KB - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
celex/celex.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
celex/changelog.json