Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 04:24
Behavioral task
behavioral1
Sample
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe
Resource
win10v2004-20240226-en
General
-
Target
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe
-
Size
6.3MB
-
MD5
09d3ed57114952660493d6dd78420556
-
SHA1
fc415e12f54e028977749316b7d315527ac786b5
-
SHA256
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc
-
SHA512
e37643c9c33add5be03343f8ac2b8293daea1553a41fdefd33ae35669dc8262f01a63d4befe2d5dd9a024ec38392a23c3d241dc7d0ecbe01394f10e01a326590
-
SSDEEP
196608:t+4hF+m1vG5C8pRQOz7b5b/yVLbyqyN7ank1d4RJ:tX1O1l7b5z9anw0
Malware Config
Extracted
cobaltstrike
http://43.138.112.88:5555/wJUG
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Loads dropped DLL 23 IoCs
Processes:
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exepid process 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exedescription pid process Token: 35 1556 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exedescription pid process target process PID 2820 wrote to memory of 1556 2820 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe PID 2820 wrote to memory of 1556 2820 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe PID 2820 wrote to memory of 1556 2820 cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe"C:\Users\Admin\AppData\Local\Temp\cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe"C:\Users\Admin\AppData\Local\Temp\cf2d751c9c834f20760a78df080d0f5a82c4a227a01ecfbc10efdddb9f1e2cfc.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1556
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\VCRUNTIME140.dllFilesize
85KB
MD5edf9d5c18111d82cf10ec99f6afa6b47
SHA1d247f5b9d4d3061e3d421e0e623595aa40d9493c
SHA256d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb
SHA512bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-core-file-l2-1-0.dllFilesize
18KB
MD572d542226f067dae07562fd093b0f5f0
SHA1c0f7f85753bb351c51dd8e36ca2366a3b24c73ba
SHA256e8e3550084cf30e16b16216266bc73b07c1a05bbfd94ee3f645122d3d167d7e6
SHA5122fbf32b38852def53891a73b9b33f33de96ca09102baa8c37f02d1b3d5076b26d2a32f2e79aab1009dc5b2464abf50c956c797ba4321fd37ea13900753a1d182
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-core-timezone-l1-1-0.dllFilesize
18KB
MD5f2d0493794b45c6a2629fc9c5c80f832
SHA112460ab8f625ecd0e0a02b4fa82061c2ff4644b8
SHA2568c2d7b0dca0702b8f1870c9c404f41e00624132b239deb7917096dfed8ca1507
SHA5124f44ea443413c3709c1521de0b9dc5c05ef9a4f853062e44658d7bc54663115afc1f04927797a5406b388cd5c9e226c9fea1f73f0c288999105d9db42fa257e2
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-runtime-l1-1-0.dllFilesize
22KB
MD56856722db8c9e3dbb7fc62938ad2cf1e
SHA16d1aa306d7793916adb30e9aac451b2e43516abe
SHA2563d077c3cfa0a54f6f58814deee22d3dcf4bcaad44ae405b8d31552a9afabc086
SHA51287a3c82af000fc1cfee5f12f01f077c2c87638245b2784e8827c587985f8c0014685d0d15a1498a01dcfcfe717cfbb9ee64344ae7a78aa75bdb65e2a0aef07cd
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-time-l1-1-0.dllFilesize
20KB
MD5f862bd9516845b31973ba98e9f1288b3
SHA1ada580fc93b4f5a86db92e1d612293ccc21c72f9
SHA25672d31abee96fb3ee1d90afcf11fdc54ceba131bbb912b994761f32cd7cfc3ee1
SHA512bb442aab30bb0d8797586eaafa53a6deaaaff19d41342b9fb828c87fc468d96953f8ed1123ace4c4d371f9eed91c2bf2c42b1d8ca92bbd0a89bc5a27a877a15e
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\base_library.zipFilesize
767KB
MD546443819f1b99332e2e37dbb6496088c
SHA1f1cb8dca548a75c83870dd67564d60c74061fa0a
SHA256e73fffa46200d9bf0172059d3a656588dfc35bba25351a298eefa4840d3521d7
SHA5125d8ec0848e640bf2c9043cedce3f25ff0d65147abf1fe0476be6d7417b1c82487851a90cef30185e034efbfce857809bb609a3b8a8bcc1690d38b31a7585a2ad
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\python36.dllFilesize
3.4MB
MD593de8b996048d9090d7d6b36e7c22c58
SHA1d6d8ceb8a871a2b837989f5bc8517922364fb062
SHA25689a963d8b75e2c23cc8d0c24d72e2662424cd9006dece16bc93fb5d3a3f665fa
SHA512bc34ea015d763e50dd3e7c3791b224c1ea242e87b35c178baedff46075fbe61bccd9ff6cae997f63922dea5f8c2f3e2ff6396cf64b9f5ca7979dd08c72186d89
-
C:\Users\Admin\AppData\Local\Temp\_MEI28202\ucrtbase.dllFilesize
978KB
MD5cca4929ef8dd988d7221ef6ba398f1b5
SHA11d21e60e56a15038702dc18148be8cecee279890
SHA2564292c29e74d90aef21bbad50e8fe25858c5990846adb629372ca6fd717cd0ca3
SHA512d990d1370201541e7a1e1ec9b68e40a984d0195847010919148d0de80d2a2c51bcccfeeca59087fca95ab410c9e170c4585c8daa1383f1383b98500d797a41ca
-
\Users\Admin\AppData\Local\Temp\_MEI28202\_ctypes.pydFilesize
127KB
MD541d0a0a29151e675334f780c941c159f
SHA1effc2358cd8b29a7dd838d854bdd985ef7c2ca7b
SHA256753f0ed64458b593fb181d971353742c37529a333580e83f8af4f2828dc65b81
SHA51243c8a7b8f12b14f33cc21a2e312be32da1cf1dccbed72d0765930075bca7914f549ccfd4233f1e9410cd0909e36eb4cf5e32f7c1af8e914ed2c4c2b139a4432a
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-core-file-l1-2-0.dllFilesize
18KB
MD5285e3257c5a12d3384cd3f5a3ae941b2
SHA1c05f6a72b73bc7ec8409ed42ccd947f501da0166
SHA2568355bf70788c00fb1a17bc4160bcdc6930fa219b85473e08138efc10136d90eb
SHA512f1ee0689b02e6a6e95940c1b3c2cc6902f3e04db44f4d767a1e68a890b7b3733b28c1d86f1f361f0db8b1ee955f5f5bca86b758b8f2e93d94b5bc4d469187df5
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-core-localization-l1-2-0.dllFilesize
20KB
MD555902b92bbbca7a2d11a946297f583e6
SHA1b6158f009d98a98ed2e56d377f9c4b6323b852fc
SHA2562dea4ae5df0f7daa37e26dd0f9232f867884f57e850aa85062594b54f3a81e98
SHA51285e0df8a390260e4e0cc0a9372dfd3c55464486812926775a5f9f5767157b88783e03701b1f1c28f34e822b21ea7436c3e8270df58f8de3ec1b15f68b633f4fd
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-core-processthreads-l1-1-1.dllFilesize
18KB
MD5d2eeb9f6789213bfda7fe6bcb2a1540a
SHA1c330267c8abd56c04204deee9aabd566268daf97
SHA2560ec2b6ee5e8ee5ee22b810795d097dd769ef054eb394355eecac1a1fdc18c971
SHA5127795e972f46ec84cb1709354a40684593947cbf6b4df373cd823134a0b2deec7e5dc738a74c13c2accb74c467892d9a2375a96ab85147ae42fadc627a0f7e2cf
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-conio-l1-1-0.dllFilesize
19KB
MD5d2de2615f123ce2bed3332d505a99385
SHA19f2ea75348020d271222fff7984c8ef21aee460e
SHA256da36262bd3865024a6ec9726b8fcd0764ef3ddafe21387314c0bbb89a478e4e9
SHA512a5e99e724a847c2193ce052dbedf0cd19a8765e3561ec028cd28e5972c8f004e257de0d5dd3870d41213a6cc84492ad488bd05106d2b5d3aa19f808eec820d51
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-convert-l1-1-0.dllFilesize
22KB
MD566a41a8156a7f9cae4a7977cb8084fa7
SHA14c72b0d8c90daf993fa0371269af04703a81fe4d
SHA256a454bd7a8fb18d19e3264855ec7ade9820b54fab31f9528bf1abc8cfe32e064b
SHA512989ec1a0deff20bc9b3099a21bf9d45bf821e94eabfc1b18ba4ece1689d0cbcf83b6206bcf64530a55aac1d4165a54c395f8db17fe5d68778082dfb1db4f0d10
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-environment-l1-1-0.dllFilesize
18KB
MD589abe10555d85e9bd183fae2c37d7aaa
SHA105c72b53f7d7b0667ff6cb14255e5c6453f1f35a
SHA256d524f5aff8a3deaf37899187fed40b821c5e79251b99d0a8571b62ad87adffb2
SHA5127b9c38e5270c401acb1b51ccf82ff0249671c4df905c31bc934d8d0b15a6eae22d3d82381199e4d61ac717bbe72726bd2f9b6c4b2fc930b39ec2c31d9fb1147d
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-filesystem-l1-1-0.dllFilesize
20KB
MD57dbc1ca1f1103cd971a67709d5203dbd
SHA1717e689b96a5d029558e7cb663d5c7cda840b780
SHA25688a6dc7c08725b447dd1b7061990977246dc62b7282dfb50fa36659627079fb1
SHA512ec58c7bb26f669f5b90731ab8c787b3b4e4131d7a9450dfae4d74ef24541a51c98ee8cc71dd4744a242dfde2f75feb216727daccb18bf745e2539546fef746d0
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-heap-l1-1-0.dllFilesize
19KB
MD5dedf6460cb6fc8229b3e889d1b32f75e
SHA1f47e35654cb90ed4505ba49a92b2fdc661c0fe8a
SHA256bae857fe8e162640032aa8d7a88217a021810d305bc58b8f27409155f2299adb
SHA512b1ce0119c2eb87ee36fe566477d14d317d01465319b72f7afd2f83a88f82591afb6f795eef76b20c0b13060530f67a4dc07923fd2f61922fdea06973c70f8352
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-locale-l1-1-0.dllFilesize
18KB
MD521f5271a151394a654b2f1c44fc44049
SHA11d2f98700ee87fc747b230b908fea133b730bf0a
SHA256a7a987527a2f7ad4474cc5be04e5bbc10375e072573b13a2cf3fe705789bf822
SHA512cc46e3bdcd25f2d72802581955ee69af97781b19a40a51fb318206ca6916f188f40dd94a7a5e6bc2c4c2ce211229d03e50729b168ed771e52cee188d0c30638d
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-math-l1-1-0.dllFilesize
27KB
MD5514a74d1050e7bdcbb1f422fb571c351
SHA15a82976e2456fe3f215316a85301460c6af389d7
SHA25662e97230bbe85c0e2930d16cadf830acdbf9f2bccedd3d51fa8ee0c5102ac63a
SHA512f2b19fe5fc4f95ec3a1b0d76e8e6767234c83a8b8a08ec6a2ba9b3620c08f67132fb7629235aee27ec172d6efa5260209e005564467abe3ec06f1a7756d21da0
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-process-l1-1-0.dllFilesize
19KB
MD590d42fdf308dfd771797dd41585d3baf
SHA1daea1f05092de97ea558de14b4e112ad48b77726
SHA256404ff7454e8dd3d766e433def1780a265ddc87a07981d223d241a528cc78c0fe
SHA512e8f35f6087b9601d8a46b2534634f24a2841ff2cde9f6b7bc10326cf2197e98bae9c6ddcb2e53e8f81a984019b72080d1e826731fb6d7c28fdb47373c1e474f5
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-stdio-l1-1-0.dllFilesize
24KB
MD5dec83f473e43ee78e92a4b682a9a7904
SHA1ce5e0479c78ad6ffa7d765479a7e1a7157eca4a3
SHA256a5c05a8394c5aa71441ac18e945170a755d1f1ff141e614cdd92dc5737426a5b
SHA51260bbd86035bbf3f80c17a01fb44ea5af5c84584a8aa5f34a7e0abf989ccccf8d40bab4d44af364c8ccf62ce4e21df0ed2c51bb70e817b2bf9c5319dbfd4100d3
-
\Users\Admin\AppData\Local\Temp\_MEI28202\api-ms-win-crt-string-l1-1-0.dllFilesize
24KB
MD588b5f9bc871438973ef12782e0c8d12f
SHA1d327208b4f26c1c6f0e9df50ecb22a89b426465d
SHA2564691510b2bc2ba15b638a0d1765c2a8826a8b9fdbe3737989d8fea072fe7c20b
SHA512d4de343a88c9933af67c4599d308f31332ca7a3ea0428fbad2d60e2fa2165eca9ea56410437be1154c551e7263dd6a5773e6f7c4dc5b6952e8b767a3c5b16597
-
\Users\Admin\AppData\Local\Temp\_MEI28202\pywintypes36.dllFilesize
133KB
MD51bd3075cbff50b3761065efa900b9dbd
SHA194a43392a5f1644d5c0809704afb21a3df28f94f
SHA25688653bb3828f9a4ce988ff92f56976e08540cbe14bd8d87bab5dd044e0d5a66e
SHA512b673714e4756b635592a117d5ebba2960ecc8c856bb5d8bd30b6ad2154906606b131b0771c12f29cfb0e110f45fedb25834d2da96b523040da4f5bbcfe62c051
-
\Users\Admin\AppData\Local\Temp\_MEI28202\win32gui.pydFilesize
237KB
MD5c56101dd4ee240ae8770b54cd5ad1525
SHA169e770986f7cad500fabfe6d9abb8fd791f9ccc2
SHA25630623bc9bf3f8f7e123fab2981bf63c96909d7889e4e09c44345f7332414708f
SHA51296fe6ae1e1d14ecd27e036c80d1203fd2b311f02072e7081d80716eaac6972d84169398aced380a6823840defd8a9499b88a27155fee6e578c5fa7fe0a6b8f48
-
memory/1556-100-0x0000000001F40000-0x0000000001F41000-memory.dmpFilesize
4KB