cs2_loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2_loader.exe
Size 402KB
Sample261110-ejj83ayxds
SHA256 bdfe2c93c30835701675e9f5d8df83c94a1b5e42d8ff1e12a72d45325ec1052a
MD5 947beed29c9b7d0807a4960d85760f86
SHA1 29c5a47d5711852724af87c8693b6c247a3a48bb
SHA512 d259ecfeb3c91593e9b7503f0fc1395125baaef7f99cb21116f7c48e037d507c4a888c980c1ec87bb562ed0adde295c8f69f641e73ab45fae0f35fc0fca24ff9
SSDEEP 6144:b3DrIHlV0P4Ie3y3cd2LP7h8sNG8LEVK8RBvVzfJq5:j/ky4Iky3cd21w8LEIaHz
TLSH
T136947E15EAA810FDE1B7D1B9CD578902EB71784A0370AEDF039449A61F176E48E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2_loader.exe

File Explorer

cs2_loader.exe

.exe 402KB

cs2_loader.exe

IMPHASH ad0ce76d5e7850d645c5eaf598e48d9d
SHA256 bdfe2c93c30835701675e9f5d8df83c94a1b5e42d8ff1e12a72d45325ec1052a
MD5 947beed29c9b7d0807a4960d85760f86
SHA1 29c5a47d5711852724af87c8693b6c247a3a48bb
SHA512 d259ecfeb3c91593e9b7503f0fc1395125baaef7f99cb21116f7c48e037d507c4a888c980c1ec87bb562ed0adde295c8f69f641e73ab45fae0f35fc0fca24ff9
SSDEEP 6144:b3DrIHlV0P4Ie3y3cd2LP7h8sNG8LEVK8RBvVzfJq5:j/ky4Iky3cd21w8LEIaHz
TLSH
T136947E15EAA810FDE1B7D1B9CD578902EB71784A0370AEDF039449A61F176E48E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

121696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

user32

CharLowerW GetWindowThreadProcessId GetWindowTextA EnumWindows

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle

bcrypt

BCryptGenRandom

kernel32

SetEndOfFile HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP GetModuleFileNameA Process32First WriteProcessMemory SetLastError SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle WriteFile OutputDebugStringA GetEnvironmentVariableA GetVolumeInformationA WaitForSingleObject GetModuleHandleA K32EnumProcessModulesEx OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread GetConsoleMode GetModuleHandleExA GetTickCount64 K32GetModuleFileNameExA GetLastError GetFileAttributesA Process32NextW MoveFileExA FileTimeToSystemTime GetCurrentThread LoadLibraryA QueryPerformanceFrequency Process32Next Process32FirstW CloseHandle RaiseException VirtualProtectEx WriteConsoleW GetProcAddress VirtualAllocEx ReadProcessMemory SetConsoleCP GetCurrentProcessId SystemTimeToFileTime GetModuleHandleW WideCharToMultiByte CreateRemoteThread SetConsoleOutputCP GetSystemTimeAsFileTime CreateDirectoryA GetSystemTime VirtualFreeEx QueryPerformanceCounter GetTickCount CheckRemoteDebuggerPresent GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsAlloc FlsGetValue FlsSetValue FlsFree ReadFile CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetModuleFileNameW ExitProcess TerminateProcess GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter SetFilePointerEx ReadConsoleW GetFileType GetFileSizeEx HeapAlloc HeapFree VirtualProtect LoadLibraryExW

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlUnwind

Name

.text

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cs2_loader.exe

advapi32

user32

winhttp

bcrypt

kernel32

ntdll

generic