C:\devel\Ark7\bin.win32\bdzsfx.x86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_6ec5dc0376e82b323a73774579edf87f_avoslocker_cobalt-strike.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-23_6ec5dc0376e82b323a73774579edf87f_avoslocker_cobalt-strike.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-23_6ec5dc0376e82b323a73774579edf87f_avoslocker_cobalt-strike
-
Size
507KB
-
MD5
6ec5dc0376e82b323a73774579edf87f
-
SHA1
4abba8cfda6e785f8ff59b804a89945172eb085a
-
SHA256
617d7b910ca06672823eb99259771fa286af9226c770fd52c7953a15860f7633
-
SHA512
5380ddbf24b3263bc7840a0e7cf41d75185003902dd2184a0f515c29f8dfb4d7864085b6194b1a0c1bd5bc7c70e6c2f8f6d4457da7653df1c3e181506fe46c93
-
SSDEEP
12288:f607YDwTdcxjX2z9uCt3ustRVsWt5lzbxp3dWPmEdhoBHFGWSxXR:fF7Y8Td82zgqBbJWOGWSxXR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-05-23_6ec5dc0376e82b323a73774579edf87f_avoslocker_cobalt-strike
Files
-
2024-05-23_6ec5dc0376e82b323a73774579edf87f_avoslocker_cobalt-strike.exe windows:6 windows x86 arch:x86
9668fa670179965985d6fa17fe7a20d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MultiByteToWideChar
SetFilePointer
GetLastError
GetVersion
DeleteFileW
VirtualAlloc
VirtualFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
lstrcatW
lstrlenW
GetFileAttributesA
GetFileAttributesW
lstrcpyW
CreateDirectoryW
SetFileAttributesW
GetCurrentThread
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
Sleep
IsNormalizedString
NormalizeString
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateHardLinkW
RemoveDirectoryW
CreateSymbolicLinkW
GlobalMemoryStatusEx
SetEndOfFile
SetFileTime
CreateFileA
GetDriveTypeW
WriteFile
FlushFileBuffers
GetTickCount
WideCharToMultiByte
FindClose
GetModuleFileNameW
GlobalFree
GetProcAddress
LocalFree
GetModuleHandleW
lstrcmpiW
RaiseException
LoadLibraryExW
InitializeCriticalSectionEx
SetLastError
GetCurrentThreadId
GetUserDefaultLangID
DecodePointer
GetConsoleMode
GetConsoleCP
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
LCMapStringW
CompareStringW
SetFilePointerEx
GetStdHandle
WriteConsoleW
ExitProcess
GetCommandLineW
GetCommandLineA
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
GetFileSize
CloseHandle
CreateFileW
lstrcpynW
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
FreeLibrary
LoadLibraryW
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
user32
ScreenToClient
GetWindowRect
SystemParametersInfoW
SendMessageW
CreateWindowExW
GetDlgItem
GetWindowTextLengthW
SetFocus
EndDialog
KillTimer
MoveWindow
EnableWindow
SetTimer
SetDlgItemTextW
PostMessageW
MessageBoxW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
LoadIconW
SetWindowPos
GetWindowLongW
GetWindowTextW
SetWindowLongW
DialogBoxParamW
UnregisterClassW
GetActiveWindow
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterWindowMessageW
SetWindowTextW
InvalidateRect
GetClientRect
gdi32
GetObjectW
GetStockObject
DeleteObject
CreateFontIndirectW
advapi32
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
AreAllAccessesGranted
AccessCheck
OpenThreadToken
RevertToSelf
ImpersonateSelf
GetFileSecurityW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW
ole32
CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathIsDirectoryW
Sections
.text Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ