D:\project2\crash_report\build_crashpad\crashpad\out\x86_rel\crashpad_handler.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-14_b2138ec4b23692ff2889370b8116247a_amadey_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-14_b2138ec4b23692ff2889370b8116247a_amadey_black-basta_cobalt-strike_elex_hijackloader_luca-stealer
-
Size
798KB
-
MD5
b2138ec4b23692ff2889370b8116247a
-
SHA1
10c38cf0b17e37263ffbccb06de2965e54df614a
-
SHA256
9a51c299a3031cfcf9b7d9f3f6fdde7a227231af3ec987ca83606b029d50728d
-
SHA512
81d8c75bc0ab14749c0b4835861ad286821a8110d45e7591bd17db18abc12e9dff885af612bbec54264278c788057b7a1e93002ae511c77a53c32e8e172d5c2e
-
SSDEEP
24576:86fy+z5rN622i56wF4l/NeecrPTsiMceJr:I+zp82V6wFRecrTvMHJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-05-14_b2138ec4b23692ff2889370b8116247a_amadey_black-basta_cobalt-strike_elex_hijackloader_luca-stealer
Files
-
2025-05-14_b2138ec4b23692ff2889370b8116247a_amadey_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe windows:6 windows x86 arch:x86
173fa97e44dd4e3bb6088a4192da794b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameW
GetFileInformationByHandleEx
GetCurrentProcess
RegisterWaitForSingleObject
GetQueuedCompletionStatus
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
OpenProcess
PostQueuedCompletionStatus
CreateEventW
SetEvent
CreateThread
UnregisterWaitEx
CreateIoCompletionPort
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateFileW
GetVersion
TransactNamedPipe
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FindClose
CloseHandle
TerminateProcess
ReleaseSemaphore
CreateSemaphoreW
ReadFile
GetFileSizeEx
GetStdHandle
WriteFile
SetEndOfFile
UnlockFileEx
SetFilePointerEx
LockFileEx
GetFileType
GetModuleHandleW
FormatMessageA
LocalFree
CreateDirectoryW
GetFileAttributesW
DeleteFileW
GetTimeZoneInformation
GetSystemInfo
IsProcessorFeaturePresent
VerSetConditionMask
VerifyVersionInfoW
GetProcessId
SuspendThread
ResumeThread
GetThreadContext
GetProcessTimes
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLCID
GetPrivateProfileStringW
CreateProcessW
IsWow64Process
WriteProcessMemory
Sleep
VirtualAllocEx
ReadProcessMemory
SleepEx
IsDebuggerPresent
SizeofResource
MultiByteToWideChar
LockResource
GlobalAlloc
GlobalFree
FindResourceExW
IsDBCSLeadByte
LoadResource
FindResourceW
GlobalLock
lstrcpyW
GlobalUnlock
GetPrivateProfileSectionW
VirtualFree
VirtualAlloc
VirtualProtect
DeviceIoControl
CreateFileA
SetLastError
SwitchToThread
GetFullPathNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetCurrentProcessId
GetLocalTime
OutputDebugStringW
FormatMessageW
GetCurrentThreadId
SetUnhandledExceptionFilter
GetProcessHeap
DeleteCriticalSection
GetCurrentDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
HeapDestroy
InitializeCriticalSection
VirtualQueryEx
GetFileTime
RemoveDirectoryW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetCommandLineA
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetStartupInfoW
InitializeSListHead
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetCPInfo
GetStringTypeW
GetSystemTimeAsFileTime
InitOnceExecuteOnce
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
SetProcessShutdownParameters
HeapFree
WideCharToMultiByte
SetConsoleCtrlHandler
LCMapStringEx
EncodePointer
QueryPerformanceCounter
advapi32
ImpersonateNamedPipeClient
RevertToSelf
BuildSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
SystemFunction036
RegOpenKeyExA
user32
UnregisterClassW
DestroyWindow
PostMessageW
DefWindowProcW
GetMessageW
GetWindowLongW
EnableWindow
DispatchMessageW
RegisterClassW
TranslateMessage
EndPaint
BeginPaint
InvalidateRect
LoadImageW
DialogBoxParamW
GetSysColorBrush
KillTimer
SetWindowLongW
CreateWindowExW
DrawIconEx
DrawTextW
GetDlgItem
GetClientRect
MapDialogRect
SetClipboardData
SendDlgItemMessageW
MapWindowPoints
SetDlgItemTextW
EmptyClipboard
CloseClipboard
ClientToScreen
SetTimer
OpenClipboard
GetWindowTextLengthW
EndDialog
GetWindowTextW
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
TrackPopupMenu
DestroyMenu
RegisterClipboardFormatW
GetKeyState
CallWindowProcW
GetWindowRect
SetWindowPos
SendMessageW
SetWindowTextW
ShowWindow
IsWindow
winhttp
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpConnect
WinHttpCrackUrl
powrprof
CallNtPowerInformation
ole32
CoTaskMemFree
CoCreateGuid
StringFromCLSID
OleInitialize
DoDragDrop
OleUninitialize
shlwapi
PathFileExistsW
PathRemoveFileSpecW
gdiplus
GdiplusStartup
comctl32
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
gdi32
DeleteObject
SetBkMode
SetTextColor
GetStockObject
CreateFontW
SelectObject
oleaut32
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysStringLen
shell32
ord155
SHGetFileInfoW
SHBindToParent
SHGetDesktopFolder
ShellExecuteW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 578KB - Virtual size: 578KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CPADinfo Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ