Overview
overview
10Static
static
7Unconfirme...20.zip
windows11-21h2-x64
1Coll.zip
windows11-21h2-x64
1APT29miniduke.dll
windows11-21h2-x64
3CozyBearImplant.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3ImplantCozy.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3MinidukeAPT29.dll
windows11-21h2-x64
3Nov2018New!/.ds_store
windows11-21h2-x64
3Nov2018New...es.dll
windows11-21h2-x64
10Nov2018New...ty.txt
windows11-21h2-x64
3Nov2018New...01.zip
windows11-21h2-x64
1ds7002.lnk
windows11-21h2-x64
10Nov2018New...02.lnk
windows11-21h2-x64
10Nov2018New...02.zip
windows11-21h2-x64
1ds7002.pdf
windows11-21h2-x64
1SeaDaddyIm...2).exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3SeaDaddyImplant.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3TrojanCozyBear.exe
windows11-21h2-x64
8atiagentCozyBear.dll
windows11-21h2-x64
1Analysis
- max time kernel
1483s - max time network
1502s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
27/02/2024, 09:42
Behavioral task
behavioral1
Sample
Unconfirmed 757120.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
Coll.zip
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
APT29miniduke.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
CozyBearImplant.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
ImplantCozy.exe
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
MinidukeAPT29.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Nov2018New!/.ds_store
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Nov2018New!/AudioSes.dll
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Nov2018New!/CozybearNov2018Activity.txt
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Nov2018New!/ds7001.zip
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
ds7002.lnk
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Nov2018New!/ds7002.lnk
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Nov2018New!/ds7002.zip
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
ds7002.pdf
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
SeaDaddyImplant (2).exe
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
SeaDaddyImplant.exe
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
TrojanCozyBear.exe
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
atiagentCozyBear.dll
Resource
win11-20240221-en
General
- Target out.exe
- Size 2.4MB
- Sample240227-lpd3kade66
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
- MD5 e8bc46b4b03cd9d132849cd0047e7f54
- SHA1 0ff34ebde7edc5038d80f3d4b84a93a68cd7849b
- SHA512 b43ca74add4645eb37d1f68ee1cd2b23df7291107bbfc0744c771283bb8f5a3de5dc4e7e64b9b50c0d32ed3eac1f42622a091e9bd62d158b2553740537f0f3c2
- SSDEEP 49152:+kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL947:7S+x0X4fzYQHR0MdbroK94
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 5064 4792 WerFault.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 82⤵
- Program crash
PID:5064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4792 -ip 47921⤵PID:1188