cslol-manager[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

cslol-manager.exe
Size

26.7MB
MD5

73d64e9291898388a6b5dfc304fd88b0
SHA1

9bc92b8e50d88816ea1559d564b82863db21b6cd
SHA256

d469e9531000d9db69acc05028fd095828203c7686edf437c4feae78f9ef10b5
SHA512

5266aa247c2102a07809ce93338192107ad79806f460177bc6a8acfbdc54d8e498736e87c0a1b5d6defaffad17c42d3e34a8d0262be431dd5c2b0dc843963a02
SSDEEP

393216:9n93rRwdOMgRehEwWs4iyys+nMohJF8CJsv6tWKFdu9Cn:X3FVag2Sy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cslol-manager.exe

Files

cslol-manager.exe
.exe windows:6 windows x64 arch:x64

97d53f90e0f10c4b492e33a73f7f75aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GlobalSize
GetCurrentProcessId
GetUserDefaultLangID
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
lstrcmpW
DisconnectNamedPipe
WaitNamedPipeW
WaitForMultipleObjects
GlobalFree
SetHandleInformation
CompareStringEx
GetCommandLineW
DuplicateHandle
SetEvent
Sleep
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
OutputDebugStringW
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
GetSystemTime
GetLocalTime
ResetEvent
GetSystemDirectoryW
LoadLibraryW
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
GetModuleHandleW
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FlushFileBuffers
GetFileType
SetEndOfFile
SetFilePointerEx
GetStartupInfoW
GetModuleFileNameW
GetExitCodeProcess
FreeLibrary
GetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
ConnectNamedPipe
CreateNamedPipeW
GetProcessId
UnregisterWaitEx
RegisterWaitForSingleObject
FindFirstFileExW
FindNextFileW
MultiByteToWideChar
LoadLibraryA
CompareStringW
LCMapStringW
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetGeoInfoW
GetUserGeoID
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateMutexW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ExitProcess
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFileAttributesW
SetStdHandle
HeapFree
HeapAlloc
HeapReAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
SetEnvironmentVariableW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
GetCurrentThreadId
WideCharToMultiByte
WriteFile
SetFilePointer
GetFileSizeEx
GetProcAddress
FormatMessageW
LocalFree
LocalAlloc
CreateEventW
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ReadFile
CreateFileW
GetLastError
RtlDeleteFunctionTable
RtlAddFunctionTable
GetSystemInfo
VirtualFree
VirtualProtect
VirtualAlloc
GetTimeZoneInformation
GetConsoleWindow
GetLocaleInfoW
GlobalLock
GlobalUnlock
CloseHandle
GlobalAlloc
CheckRemoteDebuggerPresent
CreateProcessW
ExpandEnvironmentStringsW
GetModuleHandleExW
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryFullProcessImageNameW
OpenProcess
GetFileAttributesExW

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

netapi32

NetApiBufferFree
NetShareEnum

ws2_32

WSAGetLastError
setsockopt
WSANtohs
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSAConnect
gethostname
WSAStartup
WSACleanup
WSAAsyncSelect
getsockname
WSAHtonl
WSANtohl
WSAIoctl
WSAAccept
htonl
ntohl
WSASocketW
getaddrinfo
freeaddrinfo
getnameinfo
getsockopt
__WSAFDIsSet
bind
htons
closesocket
select
listen
getpeername

advapi32

RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask
GetLengthSid
FreeSid
DuplicateToken
CopySid
AllocateAndInitializeSid
AccessCheck
OpenProcessToken
SystemFunction036
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey

ole32

OleGetClipboard
CoGetMalloc
ReleaseStgMedium
CoTaskMemFree
DoDragDrop
CoCreateInstance
OleIsCurrentClipboard
StringFromGUID2
CoCreateGuid
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
CoUninitialize
CoInitializeEx
CoInitialize
OleSetClipboard
OleFlushClipboard

shell32

SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHParseDisplayName
SHGetKnownFolderIDList
SHBrowseForFolderW
Shell_NotifyIconW
Shell_NotifyIconGetRect
CommandLineToArgvW
SHGetKnownFolderPath
ord155
SHGetPathFromIDListW
SHGetMalloc

user32

GetWindowRect
AdjustWindowRectEx
SetCursor
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SetParent
GetWindowThreadProcessId
GetWindow
DestroyCursor
DestroyIcon
MonitorFromPoint
GetAncestor
GetKeyboardLayoutList
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
UnregisterClassW
GetClassInfoW
RegisterClassExW
GetFocus
GetCursorPos
WindowFromPoint
ChildWindowFromPointEx
GetSysColorBrush
LoadImageW
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
GetSysColor
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatW
SetWindowTextW
RegisterWindowMessageW
IsWindowEnabled
CreateCaret
DestroyCaret
HideCaret
ShowCaret
SetCaretPos
FindWindowA
PeekMessageW
IsZoomed
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
TrackPopupMenuEx
SetCursorPos
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
RegisterClassW
EnumDisplayDevicesW
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetTouchInputInfo
CloseTouchInputHandle
GetWindowTextW
EnumWindows
RealGetWindowClassW
ChangeWindowMessageFilterEx
TranslateMessage
DispatchMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
PostThreadMessageW
CharNextExA
RegisterDeviceNotificationW
UnregisterDeviceNotification
DrawIconEx
InvalidateRect
SetWindowRgn
GetUpdateRect
EndPaint
GetClientRect
BeginPaint
ReleaseDC
MessageBeep
GetDC
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMenu
GetMenu
IsWindow
GetDoubleClickTime
SystemParametersInfoW
MessageBoxW
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
IsTouchWindow
UnregisterTouchWindow
RegisterTouchWindow
SetFocus
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsChild
CreateWindowExW
DefWindowProcW
AttachThreadInput
PostMessageW
SendMessageW
UpdateLayeredWindowIndirect
GetDesktopWindow
GetCaretBlinkTime
GetKeyboardLayout

winmm

timeKillEvent
timeSetEvent
PlaySoundW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1
CreateDXGIFactory2

oleaut32

SysFreeString
SafeArrayPutElement
SafeArrayCreateVector
SysAllocString

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmGetVirtualKey
ImmAssociateContextEx
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
ImmGetDefaultIMEWnd

opengl32

glLoadIdentity
glLoadMatrixf
glMatrixMode
glOrtho

gdi32

CreateDIBSection
GetTextFaceW
GetTextMetricsW
BitBlt
GdiFlush
GetBitmapBits
GetDIBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
CombineRgn
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetRegionData
SetPixelFormat
SwapBuffers
CreateRectRgn
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
GetCharABCWidthsI
DeleteObject
OffsetRgn
SelectClipRgn
SetLayout
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
CreateBitmap
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
RemoveFontMemResourceEx

uxtheme

GetThemeInt
GetThemeColor
GetThemePartSize
GetThemeBool
GetCurrentThemeName
IsAppThemed
IsThemeActive
SetWindowTheme
GetThemeEnumValue
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundRegion
ord47
CloseThemeData
GetThemeTransitionDuration
GetThemePropertyOrigin
GetThemeMargins
OpenThemeData

dwmapi

DwmGetWindowAttribute
DwmIsCompositionEnabled
DwmSetWindowAttribute
DwmEnableBlurBehindWindow

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

iphlpapi

ConvertInterfaceNameToLuidW
GetAdaptersAddresses
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToGuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToIndex

secur32

ApplyControlToken
DeleteSecurityContext
FreeContextBuffer
QueryContextAttributesW
DecryptMessage
AcceptSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
EncryptMessage
AcquireCredentialsHandleW

crypt32

CertOpenSystemStoreW
CertDuplicateCertificateContext
CertOpenStore
PFXImportCertStore
CertFindChainInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertVerifyTimeValidity
CertAddStoreToCollection
CertFindCertificateInStore
CertCloseStore

bcrypt

BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

d3d12

ord102
D3D12SerializeRootSignature
ord101

d3dcompiler_47

D3DReflect
D3DCompile

dcomp

DCompositionCreateDevice

Exports

Exports

qt_qmlDebugClearBuffer
qt_qmlDebugConnectionBlocker
qt_qmlDebugConnectorOpen
qt_qmlDebugDisableService
qt_qmlDebugEnableService
qt_qmlDebugMessageAvailable
qt_qmlDebugMessageBuffer
qt_qmlDebugMessageLength
qt_qmlDebugObjectAvailable
qt_qmlDebugSendDataToService
qt_qmlDebugSetStreamVersion

Sections

.text
Size: 16.7MB - Virtual size: 16.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 942KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 865KB - Virtual size: 865KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97d53f90e0f10c4b492e33a73f7f75aa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

userenv

version

netapi32

ws2_32

advapi32

ole32

shell32

user32

winmm

d3d11

dxgi

oleaut32

imm32

opengl32

gdi32

uxtheme

dwmapi

wtsapi32

iphlpapi

secur32

crypt32

bcrypt

d3d12

d3dcompiler_47

dcomp

Exports

Exports

Sections

.text Size: 16.7MB - Virtual size: 16.7MB

.rdata Size: 7.6MB - Virtual size: 7.6MB

.data Size: 942KB - Virtual size: 1.0MB

.pdata Size: 865KB - Virtual size: 865KB

.qtmetad Size: 5KB - Virtual size: 5KB

.qtmimed Size: 315KB - Virtual size: 315KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 176KB - Virtual size: 176KB

.reloc Size: 134KB - Virtual size: 133KB

.text
Size: 16.7MB - Virtual size: 16.7MB

.rdata
Size: 7.6MB - Virtual size: 7.6MB

.data
Size: 942KB - Virtual size: 1.0MB

.pdata
Size: 865KB - Virtual size: 865KB

.qtmetad
Size: 5KB - Virtual size: 5KB

.qtmimed
Size: 315KB - Virtual size: 315KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 176KB - Virtual size: 176KB

.reloc
Size: 134KB - Virtual size: 133KB