Statik Analiz — ResourceDropper | Tehdit: MOYEN
Fichier Kimligi
| SHA256 | 9ef1cd4cb8ea11e2353228c324a79d074ef1326815abbe2916ea32bdc69960ac |
|---|---|
| Taille | 141,312 byte (PE32+ GUI x86-64, 6 sections) |
| Imagebase | Suspicious |
FindResourceA + LoadResource + LockResource: Gizli PE Payload
KERNEL32.dll -> FindResourceA\nKERNEL32.dll -> LoadResource\nKERNEL32.dll -> LockResource\n+\nKERNEL32.dll -> CreateFileA\nKERNEL32.dll -> WriteFile\nKERNEL32.dll -> CreateProcessA\n\n-- Klasik resource dropper paterni:\n 1. FindResourceA: gizli veri PE kaynak bolumunde (RT_RCDATA)\n 2. LoadResource + LockResource: bellek pointer al\n 3. CreateFileA + WriteFile: gecici dosyaya yaz\n 4. CreateProcessA: calistir\n-- Avantaj: payload PE kaynaginda gizli, strings analizi goremez\n-- CryptGenRandom: rastgele dosya ismi uret -> AV imzasini atla
InternetOpenA + InternetOpenUrlA: HTTP Indir
InternetOpenA\nInternetOpenUrlA\n\n-- WinINet HTTP istemcisi: C2 veya payload URL-den indir\n-- InternetOpenUrlA: dogrudan URL acilisi (GET/POST)\n-- Iki mod muhtemelen:\n 1. Resource icindeki payload calistir\n 2. Sonra URL-den ikinci asama indir\n-- C2 URL: PE kaynak icinde sifrelenmis (statik analizde gorunmez)
CryptGenRandom: Rastgele Fichier Adi
CryptAcquireContextA + CryptGenRandom\n\n-- Kriptografik guclu rastgele bayt uret\n-- Kullanim: drop edilen dosyanin adini ve konumunu rastgele yap\n-- Her calissmada farkli dosya yolu -> hash-tabanli AV tespiti zorlastr\n-- %TEMP% altina: abc123.exe, def456.dll vs (her seferinde degisen)
IOC
| SHA256 | 9ef1cd4cb8ea11e2353228c324a79d074ef1326815abbe2916ea32bdc69960ac |
|---|---|
| Teknik | PE resource hidden payload + HTTP download |
| Bypass | CryptGenRandom random filename per execution |
ResourceDropper — Profil du malware
PE64 resource dropper. FindResourceA+LoadResource+LockResource payload extraction from PE resource section. InternetOpenA+InternetOpenUrlA HTTP second-stage download. CryptGenRandom random filename for AV evasion. CreateProcessA payload execution.
Type de malware
Loader
Langage de programmation
C/C++
Protocole C2
HTTP
Systèmes ciblés
Küresel
Capacités et comportement
Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı
Liste IOC (1 indicateurs)
IOC — ResourceDropper
# SHA256
9ef1cd4cb8ea11e2353228c324a79d074ef1326815abbe2916ea32bdc69960ac
| Type | Valeur | Note |
|---|---|---|
| sha256 | 9ef1cd4cb8ea11e2353228c324a79d074ef1326815abbe2916ea32bdc69960ac |