Overview

overview

10

Static

static

10

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 06:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk.exe
  • Size 10.3MB
  • Sample240607-hc223sce38
  • SHA256 be3d50fede3068ef0a880b1fd951756c8bfc30f63063a4fa2a627275f717febf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://192.168.0.102:80/4Kjt

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_687220a9fca3a2582e102f3e2fcb1688_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:556
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1444

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\VCRUNTIME140.dll
          • Size 99KB
          • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\_ctypes.pyd
          • Size 122KB
          • SHA256 3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\_socket.pyd
          • Size 77KB
          • SHA256 4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\base_library.zip
          • Size 768KB
          • SHA256 f857b4329158eeb117a00b3aae5d839c8c477e2ff30295f6219e2840b5d3a7cf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\python39.dll
          • Size 4.3MB
          • SHA256 0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\python39.dll
          • Size 448KB
          • SHA256 56967d16635268407070b9e8ea4ed92e83b16c1fb0c670b1217ee6bde57b8d5b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\select.pyd
          • Size 26KB
          • SHA256 1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          shellcodeCreateNew.exe.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\shellcodeCreateNew.exe.manifest
          • Size 1KB
          • SHA256 e377f12ff2dd3eaaff4ebb0d3f485533f2703d1d1c5d419ffe4cef04c724deb4
          • MD5 SHA1 SHA512
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\ucrtbase.dll
          • Size 384KB
          • SHA256 f56b09faf8d8945d28b6592f0dcb389f03e64614872b0993af9299f7c3527288
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35442\ucrtbase.dll
          • Size 448KB
          • SHA256 f55b0ae61fb9fef99bf8d2da4713a26573c8a44ccf99cc568b31738bea59c1d0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/556-1001-0x0000026B97B40000-0x0000026B97B41000-memory.dmp
          Download