Overview

overview

10

Static

static

3

2024-04-10...uk.exe

windows7-x64

10

2024-04-10...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 01:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-10_65d0b8b35444a92f4e43f108d5946646_cobalt-strike_ryuk.exe

  • Size

    404KB

  • MD5

    65d0b8b35444a92f4e43f108d5946646

  • SHA1

    2ede8672f7415269db1d2ce047ebaa9e4bc0b3f5

  • SHA256

    c3fa379439346be901dce4362055d9b96bebbd3ebb0032e701f4dc57ec992a52

  • SHA512

    016f2ef7717c7d45ab9397e0f6d6227d75d986da79d95fa537402eddf52a4184ccf231496d837b08af9483270371ae8a6e9b48e66ece916db360a6eff5c77141

  • SSDEEP

    6144:5/wBUQpZh6eH9W5QO2rdrTBvHJJeWFkT0MxkPkJIpSRpetjhH0jn6Evs6w21NYUI:5P6YeH8DErTtuWKwMyPsHRpetVa9LN

Score
10/10
cobaltstrike0426352781backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://120.24.47.154:8080/news/details

Attributes
  • access_type

    512

  • host

    120.24.47.154,/news/details

  • http_header1

    AAAACgAAACZBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94bWw7Ki8qOwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAAEAAAABZIb3N0OiBkcml2ZS5nb29nbGUuY29tAAAACgAAAEtDb29raWU6IFNJRD1Lc1kwZjNmeEllQkxRUm4yd0hNaGdKdlRrRmJXWklFcU55QUJnWF9udmVCdG05TGVFbXNIbjZJOU9tWXpwdzsAAAAHAAAAAAAAAA0AAAAIAAAADQAAAAUAAAACaWQAAAAJAAAAA3U9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94bWw7Ki8qOwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAAEAAAABZIb3N0OiBkcml2ZS5nb29nbGUuY29tAAAACgAAAEtDb29raWU6IFNJRD1Lc1kwZjNmeEllQkxRUm4yd0hNaGdKdlRrRmJXWklFcU55QUJnWF9udmVCdG05TGVFbXNIbjZJOU9tWXpwdzsAAAAHAAAAAQAAAA0AAAAGAAAADVgtQ2xpZW50LURhdGEAAAAHAAAAAAAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • polling_time

    5000

  • port_number

    8080

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDzESqSDKV1cyVnt70NdVdeDYcFXdZy1+CIbBvbl7whKuDauX8H8mINREJZZYdIvzBPuG17JyWp14ofhEFb6LWu6r8PUpn8kmysMSgDsDxvty4s5qXdS5RSwrC6odUpNMsyTvMBSa2JyQ71VNJb4imtUItraCDpBh98trcWQ3Ip/wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /service/api/json

  • user_agent

    Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

  • watermark

    426352781

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-10_65d0b8b35444a92f4e43f108d5946646_cobalt-strike_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-10_65d0b8b35444a92f4e43f108d5946646_cobalt-strike_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
    • \??\c:\windows\notepad.exe
      "c:\windows\notepad.exe"
      2⤵
        PID:2460

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2460-1-0x000007FEF7B00000-0x000007FEF7BAC000-memory.dmp
      Filesize

      688KB

      Download
    • memory/2460-2-0x000007FEF7B00000-0x000007FEF7BAC000-memory.dmp
      Filesize

      688KB

      Download
    • memory/2460-6-0x000007FEF7B00000-0x000007FEF7BAC000-memory.dmp
      Filesize

      688KB

      Download
    • memory/2460-7-0x000007FEF7B00000-0x000007FEF7BAC000-memory.dmp
      Filesize

      688KB

      Download