c:\constructicon\builds\gfx\six\24.30\install\Neoma\InstallNeoma\IN_Apps\Bin\Win64a\B_rel\Setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-16_ca1c1cc932544dc71d853cf63273b11d_black-basta_cobalt-strike_hijackloader_satacom.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-16_ca1c1cc932544dc71d853cf63273b11d_black-basta_cobalt-strike_hijackloader_satacom
-
Size
1.1MB
-
MD5
ca1c1cc932544dc71d853cf63273b11d
-
SHA1
1093c215e9dd51270e3022a9ef5c18996962898d
-
SHA256
c250e1c3db966fa7364aacdd23a129c0317ba75df1350b020103ba4321b35c94
-
SHA512
cea7c31c9f40d413bcb94a73ab68cfaba7000e67820888a5057d3eb8a43617ff31a16d389684e4444a2391efd237bd8484fe2526fb5a893201f229ef0368e522
-
SSDEEP
6144:QWAXXdP2vZcIrImko1HtA7/aiqJHFYKygqz+0Z9xwASY97p5wriWUPGxRDSesqtt:QXXdP2QyHtA7/axHZydzHz997asiW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-05-16_ca1c1cc932544dc71d853cf63273b11d_black-basta_cobalt-strike_hijackloader_satacom
Files
-
2025-05-16_ca1c1cc932544dc71d853cf63273b11d_black-basta_cobalt-strike_hijackloader_satacom.exe windows:6 windows x64 arch:x64
a7d025d31a4e63cfaf564e19d9eaf664
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
SetDefaultDllDirectories
lstrlenW
MultiByteToWideChar
CreateFileW
GetLogicalDriveStringsW
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetSystemInfo
GetProcAddress
LocalAlloc
LocalFree
WideCharToMultiByte
GetUserDefaultUILanguage
CloseHandle
FindFirstFileW
FindNextFileW
SetEvent
CreateEventA
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
OutputDebugStringW
GetDriveTypeW
FindClose
GetModuleHandleW
RaiseException
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
FormatMessageA
GetLocaleInfoEx
GetStringTypeW
GetCurrentDirectoryW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetStdHandle
WriteFile
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
RtlUnwind
imagehlp
ImageGetCertificateData
ImageEnumerateCertificates
crypt32
CertGetNameStringW
CertFreeCertificateContext
CryptVerifyMessageSignature
Sections
.text Size: 378KB - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 568KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ