WinUpackv039finalrelocatedimagebaseByDwingc2005h2

Hunt Hypothesis

This detection identifies potentially malicious executables that utilize a relocated image base, a technique often employed by packers or obfuscation tools to evade static analysis and hide code modifications. Proactively hunting for this behavior in Azure Sentinel is essential because such relocations frequently indicate the presence of packed malware or custom loaders that may bypass standard signature-based defenses until they execute their payload.

YARA Rule

rule WinUpackv039finalrelocatedimagebaseByDwingc2005h2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 [3] 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the WinUpackv039finalrelocatedimagebaseByDwingc2005h2 detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Microsoft Office Updates via Configuration Manager (SCCM)

  • Context: The rule triggers when the SCCM client service (ccmexec.exe) executes a background update task that unpacks an Office installation package. This process often involves relocating image bases during the extraction phase, mimicking the behavior of the Dwingc2005h2 packer signature.
  • Suggested Filter/Exclusion: Create a whitelist rule excluding processes where the parent executable is ccmexec.exe and the file path contains \Microsoft Office\Update. Additionally, filter out events occurring during defined maintenance windows (e.g., 01:00–05:00 local time).

• Scenario: Antivirus Real-Time Scanning of Compressed Archives

  • Context: Enterprise Endpoint Protection suites like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently unpack .zip or .cab archives containing software installers. When these tools scan the extracted content in memory, they may generate a relocated image base event that matches the YARA signature, particularly when scanning large deployment bundles.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is MsMpEng.exe (Defender) or FalconSensorService.exe (CrowdStrike). Implement a logic check to ignore events if the file extension of the scanned artifact is .zip, .cab, or .msi.

• Scenario: Automated Deployment via PowerShell DSC (Desired State Configuration)

  • Context: During routine infrastructure drift remediation, PowerShell DSC agents (DscService) often extract and apply configuration packages.