Overview

overview

10

Static

static

10

2024-06-07...uk.exe

windows7-x64

1

2024-06-07...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 06:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk.exe
  • Size 10.3MB
  • Sample240607-g61wfacb42
  • SHA256 b7d2ef3a940e1d757f9a22044097874e446f42d11ea8456987fd981213322fc6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://192.168.0.102:80/4Kjt

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_296060397e0a893cb6126dd2ff3761ef_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:1676

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\VCRUNTIME140.dll
        • Size 99KB
        • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\_ctypes.pyd
        • Size 122KB
        • SHA256 3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\_socket.pyd
        • Size 77KB
        • SHA256 4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\base_library.zip
        • Size 576KB
        • SHA256 4fb2e16ef8b73d4a88b651640ad0e16a944007610552bb263ea95a82bdbc1a58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\python39.dll
        • Size 448KB
        • SHA256 56967d16635268407070b9e8ea4ed92e83b16c1fb0c670b1217ee6bde57b8d5b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\python39.dll
        • Size 512KB
        • SHA256 5f5ca15755139f7821ca0a0999a21d4c13cf74fa50fb24562e08cd0d7c4484d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\select.pyd
        • Size 26KB
        • SHA256 1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        shellcodeCreateNew.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\shellcodeCreateNew.exe.manifest
        • Size 1KB
        • SHA256 e377f12ff2dd3eaaff4ebb0d3f485533f2703d1d1c5d419ffe4cef04c724deb4
        • MD5 SHA1 SHA512
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\ucrtbase.dll
        • Size 576KB
        • SHA256 6e5bee4c380f3287d6cfab9bd6bae3b7de4db7bafbc60e8cb3e7cf674d8a4143
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI36522\ucrtbase.dll
        • Size 448KB
        • SHA256 f55b0ae61fb9fef99bf8d2da4713a26573c8a44ccf99cc568b31738bea59c1d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1676-1001-0x000001F97EDD0000-0x000001F97EDD1000-memory.dmp
        Download