_ReflectiveLoader@4
Behavioral task
behavioral1
Sample
daee0f071565ddcef75af252c3fabbfc430d9c3b89764542ec6b5f1d0819daa6.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
daee0f071565ddcef75af252c3fabbfc430d9c3b89764542ec6b5f1d0819daa6.dll
Resource
win10v2004-20240802-en
General
-
Target
daee0f071565ddcef75af252c3fabbfc430d9c3b89764542ec6b5f1d0819daa6
-
Size
236KB
-
MD5
bf814a1bc330a3d2f25593dde477b2cc
-
SHA1
a6a1c1736c00f6b74c32268aa0d71c898ea8fc11
-
SHA256
daee0f071565ddcef75af252c3fabbfc430d9c3b89764542ec6b5f1d0819daa6
-
SHA512
36620c78d0bdb9cd07c7569887da1118c8c4f5d72eb5faab4a54d37d5ce9d8238cf81c02dd97c9c1d4543ed13a289c0048c0695b6ef55f485c5cfb7286fb14da
-
SSDEEP
3072:t0QQVOcISjb+5kKTa0sEuZ7c8JbhjVmmjEUrMvi:+P+SjTQa0s2AjV9jT
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource daee0f071565ddcef75af252c3fabbfc430d9c3b89764542ec6b5f1d0819daa6
Files
-
daee0f071565ddcef75af252c3fabbfc430d9c3b89764542ec6b5f1d0819daa6.dll windows:5 windows x86 arch:x86
34489d88b1ebbc1f551596a9c4d56656
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ReadProcessMemory
CreateProcessA
TerminateProcess
GetCurrentDirectoryW
VirtualProtectEx
WriteProcessMemory
ResumeThread
GetFullPathNameA
SystemTimeToTzSpecificLocalTime
GetLogicalDrives
ExpandEnvironmentStringsA
GetFileAttributesA
FileTimeToSystemTime
FindFirstFileA
CopyFileA
FindClose
MoveFileA
FindNextFileA
VirtualProtect
PeekNamedPipe
OpenProcess
GetCurrentProcessId
Thread32First
Thread32Next
VirtualAllocEx
OpenThread
CreateToolhelp32Snapshot
CreateThread
CreateRemoteThread
SetThreadContext
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetLastError
GetVersionExA
CreateFileA
WaitNamedPipeA
SetNamedPipeHandleState
GetComputerNameA
GetACP
GetModuleFileNameA
GetOEMCP
DeleteProcThreadAttributeList
GetThreadContext
HeapFree
GetProcessHeap
InitializeProcThreadAttributeList
SetErrorMode
UpdateProcThreadAttribute
ProcessIdToSessionId
DuplicateHandle
Process32First
Process32Next
VirtualQuery
ExitProcess
ExitThread
ReadFile
GetCurrentThread
GetCurrentProcess
GetCurrentDirectoryA
CreatePipe
GetLocalTime
GetStartupInfoA
SetCurrentDirectoryA
MultiByteToWideChar
WriteFile
GetTickCount
WaitForSingleObject
LocalFree
CloseHandle
LocalAlloc
CreateNamedPipeA
GetLastError
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
Sleep
GetModuleHandleA
GetModuleFileNameW
DebugBreak
RaiseException
SetEnvironmentVariableW
LoadLibraryA
VirtualAlloc
GetProcAddress
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetCPInfo
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
VirtualFree
HeapAlloc
FreeLibrary
GetModuleHandleW
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
advapi32
CreateProcessWithTokenW
InitializeSecurityDescriptor
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
LogonUserA
CheckTokenMembership
RevertToSelf
LookupAccountSidA
GetTokenInformation
GetUserNameA
DuplicateTokenEx
SetEntriesInAclA
CreateProcessWithLogonW
CreateProcessAsUserA
AdjustTokenPrivileges
ImpersonateNamedPipeClient
ImpersonateLoggedOnUser
LookupPrivilegeValueA
OpenThreadToken
OpenProcessToken
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
ws2_32
send
bind
socket
closesocket
listen
connect
WSAStartup
WSACleanup
gethostbyname
ntohl
ntohs
ntohl
accept
recv
ntohs
inet_ntoa
shutdown
WSAGetLastError
ioctlsocket
__WSAFDIsSet
select
gethostname
Exports
Exports
Sections
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ