E:\work\AutoUpdate\Release\AutoUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-10_627caf3637517c639f96149d9f1dc3e9_avoslocker_cobalt-strike.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-10_627caf3637517c639f96149d9f1dc3e9_avoslocker_cobalt-strike.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-10_627caf3637517c639f96149d9f1dc3e9_avoslocker_cobalt-strike
-
Size
498KB
-
MD5
627caf3637517c639f96149d9f1dc3e9
-
SHA1
17723dcd4ffe28cd04f29e1657992ace046fec51
-
SHA256
df27dbe829ac31564a5421d4c8cfef1800743e38e31dd5b346b2cf15fa79ed31
-
SHA512
37cde3b0ea6a1b7b2c502f4614f4d46965db8b4733907338b8f0e0730f17ce3783764693bbea745c033ef3eedbabff20bb0537e3a40a6bf6f43b23e8d73a6b7c
-
SSDEEP
12288:pcwVI6GnEpP2JYY7rUc7UVGIWapDTi7a841XPiYhPIkGM:pdLrpPlYpBIWa9Ti7a841/iYhP8M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-10_627caf3637517c639f96149d9f1dc3e9_avoslocker_cobalt-strike
Files
-
2024-08-10_627caf3637517c639f96149d9f1dc3e9_avoslocker_cobalt-strike.exe windows:6 windows x86 arch:x86
2ce2f01f832240ca8451e82ad929e795
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoW
GetSystemDefaultLCID
GetCurrentProcess
OutputDebugStringA
GetModuleFileNameW
GetSystemDefaultLangID
SetFileAttributesW
GetLastError
GetProcAddress
GetModuleHandleW
FindNextFileW
GetTempPathW
FindClose
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
DeleteFileW
SetEndOfFile
FindResourceW
DeviceIoControl
LocalFree
FormatMessageA
FormatMessageW
AreFileApisANSI
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
GetStdHandle
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
GetTimeZoneInformation
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
WriteConsoleW
HeapSize
HeapReAlloc
DecodePointer
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
LoadResource
LockResource
Sleep
CreateFileW
LCMapStringEx
GetLocaleInfoEx
MoveFileW
ExitProcess
SetFilePointerEx
CloseHandle
InitializeCriticalSectionEx
SizeofResource
CompareStringEx
user32
GetParent
GetDesktopWindow
GetDlgItem
DialogBoxIndirectParamW
SetWindowTextA
SetDlgItemTextW
SetWindowTextW
GetWindowRect
SetWindowPos
MessageBoxW
EndDialog
shell32
ShellExecuteW
urlmon
URLDownloadToFileA
Sections
.text Size: 374KB - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ