Overview
overview
10Static
static
7Unconfirme...20.zip
windows11-21h2-x64
1Coll.zip
windows11-21h2-x64
1APT29miniduke.dll
windows11-21h2-x64
3CozyBearImplant.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3ImplantCozy.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3MinidukeAPT29.dll
windows11-21h2-x64
3Nov2018New!/.ds_store
windows11-21h2-x64
3Nov2018New...es.dll
windows11-21h2-x64
10Nov2018New...ty.txt
windows11-21h2-x64
3Nov2018New...01.zip
windows11-21h2-x64
1ds7002.lnk
windows11-21h2-x64
10Nov2018New...02.lnk
windows11-21h2-x64
10Nov2018New...02.zip
windows11-21h2-x64
1ds7002.pdf
windows11-21h2-x64
1SeaDaddyIm...2).exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3SeaDaddyImplant.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3TrojanCozyBear.exe
windows11-21h2-x64
8atiagentCozyBear.dll
windows11-21h2-x64
1Analysis
- max time kernel
1485s - max time network
1504s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
27/02/2024, 09:42
Behavioral task
behavioral1
Sample
Unconfirmed 757120.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
Coll.zip
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
APT29miniduke.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
CozyBearImplant.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
ImplantCozy.exe
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
MinidukeAPT29.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Nov2018New!/.ds_store
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Nov2018New!/AudioSes.dll
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Nov2018New!/CozybearNov2018Activity.txt
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Nov2018New!/ds7001.zip
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
ds7002.lnk
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Nov2018New!/ds7002.lnk
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Nov2018New!/ds7002.zip
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
ds7002.pdf
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
SeaDaddyImplant (2).exe
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
SeaDaddyImplant.exe
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
TrojanCozyBear.exe
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
atiagentCozyBear.dll
Resource
win11-20240221-en
General
- Target out.exe
- Size 2.4MB
- Sample240227-lpd3kade66
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
- MD5 3c573f4b2567c1ede2be12acc79b9f9b
- SHA1 e518fa185cfadf9893b2993df84d149088fc502a
- SHA512 f7eabdc6341570ac60d7150ac980118bd3d57d90a31f17bfe014101ca797855ec163b98a03f177e210c1d3b5bf00e54494d15d0727c1fef218e016f8683baff5
- SSDEEP 49152:8kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL948:tS+x0X4fzYQHR0MdbroK94
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 4884 1316 WerFault.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵PID:1316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 82⤵
- Program crash
PID:4884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1316 -ip 13161⤵PID:3536