Overview

overview

10

Static

static

3

2024-05-23...uk.exe

windows7-x64

10

2024-05-23...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 14:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_f741b1824d3fed14b7d629075f68d433_ryuk.exe

  • Size

    499KB

  • MD5

    f741b1824d3fed14b7d629075f68d433

  • SHA1

    4e52420a731952085cbf8f334891701da9dbfea3

  • SHA256

    45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d

  • SHA512

    de057a8f5b3a9782f805f098c1226674dd1ca8d38ea2fd2710bf085de4da33b3851ef572f2408f85f209b72959917321b45bd529a5b39630747bf14f59bb36fe

  • SSDEEP

    12288:AzZy+ToGFKWekWT5jvJKw0wnPDOrzEcl:A1LiWekWT5jvJKw0wnbOH

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://storage.termservhub.com:443/embedded/singlePageReactModel.png

Attributes
  • user_agent

    Host: storage.termservhub.com Connection: close Accept-Encoding: br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_f741b1824d3fed14b7d629075f68d433_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_f741b1824d3fed14b7d629075f68d433_ryuk.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2912-0-0x000001B9BE860000-0x000001B9BE861000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2912-3-0x000001B9C0360000-0x000001B9C0760000-memory.dmp
    Filesize

    4.0MB

    Download