celestium-loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
celestium-loader.exe
Size 1.8MB
Sample260727-apavcsgf53
SHA256 5814d542c80007b0c6a7ce4e8034289524fb96b3cef839db9d4de15958618f45
MD5 90773a6c74a1de6347d9105316040bd2
SHA1 639faa4f584d270980400cce3a5f420eb3d9378f
SHA512 f2d326496f306061729c7ba310bb2977fc3ce02ae6602022147b900378b29c87e1feb448b8932426845de011bed72e293fbb421d72dfb65ad2cc2986f3df823d
SSDEEP 49152:kOSoWayUeTd6iX5U/y68dNxE0AcNHhSf49iPijuDiY8g:fUhfp68dNxE0tNHhSvX
TLSH
T10F95AD46B3B400E9D1A7C13CC942660BDAB67C1507609BDF23A49BAA2F337E15B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
celestium-loader.exe

File Explorer

celestium-loader.exe

.exe 1.8MB

celestium-loader.exe

IMPHASH 65f0d2779ce2a44e2182f6b4dd225213
SHA256 5814d542c80007b0c6a7ce4e8034289524fb96b3cef839db9d4de15958618f45
MD5 90773a6c74a1de6347d9105316040bd2
SHA1 639faa4f584d270980400cce3a5f420eb3d9378f
SHA512 f2d326496f306061729c7ba310bb2977fc3ce02ae6602022147b900378b29c87e1feb448b8932426845de011bed72e293fbb421d72dfb65ad2cc2986f3df823d
SSDEEP 49152:kOSoWayUeTd6iX5U/y68dNxE0AcNHhSf49iPijuDiY8g:fUhfp68dNxE0tNHhSvX
TLSH
T10F95AD46B3B400E9D1A7C13CC942660BDAB67C1507609BDF23A49BAA2F337E15B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1042248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\source\repos\Perso\celestium-loader\bin\x64\Release\celestium-loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ws2_32

bind WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket getpeername getsockname WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt htons connect gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv

normaliz

IdnToAscii IdnToUnicode

crypt32

CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptQueryObject CertEnumCertificatesInStore CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CryptStringToBinaryA CertCreateCertificateChainEngine CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine

wldap32

ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord143

advapi32

OpenThreadToken RegCreateKeyW RegDeleteTreeW RegCloseKey RegSetKeyValueW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptGenRandom CryptEncrypt RegOpenKeyW

kernel32

HeapAlloc HeapReAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW HeapFree GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA ExitProcess GetModuleFileNameW WriteFile SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW DeleteFileW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation SetStdHandle SetEndOfFile HeapSize HeapQueryInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW GetModuleHandleA Sleep MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeEnvironmentStringsW QueryPerformanceCounter SetLastError GetLastError VirtualFree VirtualAlloc GetCurrentThreadId GetCurrentProcessId DeviceIoControl CreateFileW CloseHandle GetTempPathW ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA GetCurrentThread GetSystemDirectoryA SleepEx MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateFileA GetFileSizeEx GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer GetModuleHandleW GetFullPathNameW GetFileInformationByHandle FindNextFileW FindFirstFileExW FindClose GetCurrentDirectoryW LocalFree LoadLibraryExW SetEnvironmentVariableW GetProcessHeap WriteConsoleW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader GetStringTypeW TryAcquireSRWLockExclusive UnhandledExceptionFilter RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry FreeLibrary RtlUnwind SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter RtlVirtualUnwind

user32

GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetKeyboardLayout SetClipboardData DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow TranslateMessage PeekMessageA PostQuitMessage UpdateWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState GetClipboardData

gdi32

CreateRoundRectRgn

ole32

StringFromGUID2

bcrypt

BCryptGenRandom

ntdll

NtQuerySystemInformation RtlInitUnicodeString

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

urlmon

URLOpenBlockingStreamA

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

523KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

celestium-loader.exe

d3d11

d3dcompiler_47

ws2_32

normaliz

crypt32

wldap32

advapi32

kernel32

user32

gdi32

ole32

bcrypt

ntdll

imm32

urlmon

generic