C:\Users\hlz\source\repos\ConsoleApplication2\x64\Debug\ConsoleApplication2.pdb
Behavioral task
behavioral1
Sample
2024-05-04_6f7b2823216388bb8ebc4f0a62deedd5_cobalt-strike_ryuk.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-04_6f7b2823216388bb8ebc4f0a62deedd5_cobalt-strike_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-04_6f7b2823216388bb8ebc4f0a62deedd5_cobalt-strike_ryuk
-
Size
2.0MB
-
MD5
6f7b2823216388bb8ebc4f0a62deedd5
-
SHA1
875606a0a1437a588d654a23c5812400bfafc785
-
SHA256
f2a1da432826eeaf1546554a5dea259f791685613d603a4f7292c9e3328e2d31
-
SHA512
7d06a5a12e9936a00f99c8a2487019274ab4abda5cdb5ded4b88872ad588ad4f6ab44cdc4ee91a09bf9dadd84fad3440ee3786ef4dce1499f3a1e474976c67ed
-
SSDEEP
24576:BrvFNTdiqdshladSvbrGRMLzfmag3S448N+bIOV:FvvJiMsDadSveKLjmaYIl
Malware Config
Extracted
cobaltstrike
http://101.43.109.204:6666/8Rij
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-04_6f7b2823216388bb8ebc4f0a62deedd5_cobalt-strike_ryuk
Files
-
2024-05-04_6f7b2823216388bb8ebc4f0a62deedd5_cobalt-strike_ryuk.exe windows:6 windows x64 arch:x64
92a789baf24324c59ce8ba5c15cbf7c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
HeapSize
HeapValidate
GetSystemInfo
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapReAlloc
HeapQueryInformation
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
ReadConsoleW
CreateFileW
Sections
.textbss Size: - Virtual size: 698KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 361KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 355B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 306B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ