C:\jenkins\workspace\Client.den\Client\Windows\release\bin\X64\Release\CptInstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-03_9e3316571e96c1d6ea5d0beaf11f492c_black-basta_cobalt-strike_satacom_vidar.exe
Resource
win10v2004-20250610-en
General
-
Target
2025-07-03_9e3316571e96c1d6ea5d0beaf11f492c_black-basta_cobalt-strike_satacom_vidar
-
Size
1.7MB
-
MD5
9e3316571e96c1d6ea5d0beaf11f492c
-
SHA1
fc77bfab070032494beaa86f96e909b90d17d7ae
-
SHA256
47c8ed1f711a0ad6de7165a07fde1292a317ad8e9bb4553d1ae9ff2d7e3e1b04
-
SHA512
af3d390fca86f499c816c545e57c7dcfe0d6b6e597a3645123f783313a6be1a29b1823240be73f9447958fda9bfb5015ba98d34b0b03a0fbf0c33333f986ff2e
-
SSDEEP
24576:HF51++FHhx1KXMqJdENg6sC/IgOHcrks1iRF4Shz:lXZHhGBJdEIC/3gRz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-07-03_9e3316571e96c1d6ea5d0beaf11f492c_black-basta_cobalt-strike_satacom_vidar
Files
-
2025-07-03_9e3316571e96c1d6ea5d0beaf11f492c_black-basta_cobalt-strike_satacom_vidar.exe windows:6 windows x64 arch:x64
378d7490f00fc08c89c241ba295c1843
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetProcAddress
LoadLibraryExW
LoadLibraryW
LocalAlloc
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLocalTime
WideCharToMultiByte
GetModuleHandleExW
ResumeThread
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
lstrcmpA
lstrcpyW
FileTimeToSystemTime
MultiByteToWideChar
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
FlushViewOfFile
GetPrivateProfileIntW
GetModuleHandleA
WritePrivateProfileStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
SetEvent
CreateEventW
TerminateThread
GetExitCodeThread
WriteConsoleW
SetEndOfFile
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
SetFilePointerEx
GetFileSizeEx
FreeLibrary
GetVersionExW
GetSystemDirectoryW
GetSystemInfo
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
OpenProcess
CreateDirectoryW
Sleep
GetModuleHandleW
CopyFileW
CreateProcessW
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
CreateFileW
GetExitCodeProcess
MoveFileW
GetTempFileNameW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
MoveFileExW
LocalFree
DecodePointer
HeapAlloc
RaiseException
CloseHandle
DeleteFileW
GetLastError
ProcessIdToSessionId
GetFileAttributesW
WaitForSingleObject
FindClose
InitializeCriticalSectionEx
GetTempPathW
GetModuleFileNameW
RemoveDirectoryW
GetCurrentProcess
FindNextFileW
GetCommandLineW
SetLastError
HeapFree
FindFirstFileW
GetPrivateProfileStringW
GetConsoleMode
GetConsoleCP
GetFileType
WriteFile
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
GetFileAttributesExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
OutputDebugStringW
IsDebuggerPresent
GetStringTypeW
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
user32
GetSystemMetrics
advapi32
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
DeleteService
CreateServiceW
ControlService
ChangeServiceConfig2W
GetTokenInformation
SetEntriesInAclW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
shell32
SHCreateDirectoryExW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
ole32
CoTaskMemFree
shlwapi
PathFileExistsW
PathAppendW
PathFindFileNameW
PathIsRelativeW
PathRemoveFileSpecW
psapi
GetProcessImageFileNameA
rpcrt4
RpcBindingFromStringBindingW
NdrClientCall3
RpcServerUnregisterIfEx
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFree
Sections
.text Size: 262KB - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE