Malware Analysis Report

2025-03-15 08:01

Sample ID 240813-w9ejyavbmq
Target 2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike
SHA256 432b74368d8b423796bd131d396d30a14a28b4f69da1d350e010a78b4352a68e
Tags
upx 0 miner cobaltstrike xmrig backdoor trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

432b74368d8b423796bd131d396d30a14a28b4f69da1d350e010a78b4352a68e

Threat Level: Known bad

The file 2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike was found to be: Known bad.

Malicious Activity Summary

upx 0 miner cobaltstrike xmrig backdoor trojan persistence

Cobaltstrike

Xmrig family

XMRig Miner payload

Cobalt Strike reflective loader

Cobaltstrike family

xmrig

XMRig Miner payload

UPX packed file

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Drops autorun.inf file

Drops file in Program Files directory

Unsigned PE

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer start page

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-13 18:37

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A

Cobaltstrike family

cobaltstrike

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Xmrig family

xmrig

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-13 18:36

Reported

2024-08-13 18:39

Platform

win7-20240729-en

Max time kernel

55s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe"

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A

Cobaltstrike

trojan backdoor cobaltstrike

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcor.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files (x86)\Common Files\System\ado\msadox28.tlb C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files (x86)\Internet Explorer\pdm.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\System\ado\msador15.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Mail\MSOERES.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\IRIS.INF C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.msi C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.JITGfXhWCP.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.CCAftvtUTS.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe

"C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 enmfwpb224ioj.x.pipedream.net udp
US 8.8.8.8:53 WEjgTclgp.bitbucket.com udp
US 18.204.193.192:443 enmfwpb224ioj.x.pipedream.net tcp
US 18.204.193.192:443 enmfwpb224ioj.x.pipedream.net tcp
US 18.204.193.192:443 enmfwpb224ioj.x.pipedream.net tcp
IE 185.166.142.23:443 WEjgTclgp.bitbucket.com tcp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 PUM.bitbucket.com udp
IE 185.166.142.21:443 PUM.bitbucket.com tcp
US 8.8.8.8:53 d.bitbucket.com udp
IE 185.166.142.22:443 d.bitbucket.com tcp
US 8.8.8.8:53 BmxeoZAwLu.bitbucket.com udp
IE 185.166.142.22:443 BmxeoZAwLu.bitbucket.com tcp
US 8.8.8.8:53 wTILUgssoPZlBr.bitbucket.com udp
IE 185.166.142.23:443 wTILUgssoPZlBr.bitbucket.com tcp
US 8.8.8.8:53 MjCzwoqcB.bitbucket.com udp
IE 185.166.142.21:443 MjCzwoqcB.bitbucket.com tcp
US 8.8.8.8:53 OMRPMm.bitbucket.com udp
IE 185.166.142.21:443 OMRPMm.bitbucket.com tcp
US 8.8.8.8:53 NSpGpRitjLsHLJ.bitbucket.com udp
IE 185.166.142.23:443 NSpGpRitjLsHLJ.bitbucket.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 gqxsRzrqfITZNu.bitbucket.com udp
IE 185.166.142.22:443 gqxsRzrqfITZNu.bitbucket.com tcp
US 8.8.8.8:53 XDaskbUaBqlcl.bitbucket.com udp
IE 185.166.142.23:443 XDaskbUaBqlcl.bitbucket.com tcp
US 8.8.8.8:53 uEGajnbDzXdz.bitbucket.com udp
IE 185.166.142.22:443 uEGajnbDzXdz.bitbucket.com tcp
US 8.8.8.8:53 wLIxWsTJAhSsfd.bitbucket.com udp
IE 185.166.142.23:443 wLIxWsTJAhSsfd.bitbucket.com tcp
US 8.8.8.8:53 bXLVSAQAUEiL.bitbucket.com udp
IE 185.166.142.23:443 bXLVSAQAUEiL.bitbucket.com tcp
US 8.8.8.8:53 BsyAYPt.bitbucket.com udp
IE 185.166.142.23:443 BsyAYPt.bitbucket.com tcp
US 8.8.8.8:53 Zn.bitbucket.com udp
IE 185.166.142.22:443 Zn.bitbucket.com tcp
US 8.8.8.8:53 cXED.bitbucket.com udp
IE 185.166.142.22:443 cXED.bitbucket.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 www.apkmirror.com udp
US 104.19.135.58:443 www.apkmirror.com tcp
US 8.8.8.8:53 kampower.com udp
US 75.98.175.121:443 kampower.com tcp
US 8.8.8.8:53 vEh.amPiWvzeuiFrfULDRMfS.readme.io udp
US 104.16.241.118:443 vEh.amPiWvzeuiFrfULDRMfS.readme.io tcp
US 8.8.8.8:53 fRunSCvklezLH.VJlpGnYjfoUUbzTOGXVM.readme.io udp
US 104.16.242.118:443 fRunSCvklezLH.VJlpGnYjfoUUbzTOGXVM.readme.io tcp
US 8.8.8.8:53 AfCdrMTNWR.IqcpNjnWKKybkXfpJYjg.readme.io udp
US 104.16.241.118:443 AfCdrMTNWR.IqcpNjnWKKybkXfpJYjg.readme.io tcp
US 8.8.8.8:53 OHUUHF.KcrmbaEoRfrGuamJbOnr.readme.io udp
US 104.16.242.118:443 OHUUHF.KcrmbaEoRfrGuamJbOnr.readme.io tcp
US 8.8.8.8:53 xwchn.net udp
US 8.8.8.8:53 JpKB.DdYBWQNUpNcbTGfsKAas.readme.io udp
US 104.16.242.118:443 JpKB.DdYBWQNUpNcbTGfsKAas.readme.io tcp
US 8.8.8.8:53 ipfHegGo.HYReWMmcOlLLpRJxBblC.readme.io udp
US 104.16.241.118:443 ipfHegGo.HYReWMmcOlLLpRJxBblC.readme.io tcp
US 8.8.8.8:53 Xwdn.IMsWcCHAQzgQUGfZfMNd.readme.io udp
US 104.16.242.118:443 Xwdn.IMsWcCHAQzgQUGfZfMNd.readme.io tcp
US 8.8.8.8:53 ueSR.eJSiWaOWxNrcceWctqqq.readme.io udp
US 104.16.241.118:443 ueSR.eJSiWaOWxNrcceWctqqq.readme.io tcp
US 8.8.8.8:53 mcCIAjxfMH.bitbucket.com udp
IE 185.166.142.21:443 mcCIAjxfMH.bitbucket.com tcp
US 8.8.8.8:53 yW.bitbucket.com udp
IE 185.166.142.23:443 yW.bitbucket.com tcp
US 8.8.8.8:53 vab.bitbucket.com udp
IE 185.166.142.23:443 vab.bitbucket.com tcp
US 8.8.8.8:53 LSB.bitbucket.com udp
IE 185.166.142.21:443 LSB.bitbucket.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 tsY.bitbucket.com udp
IE 185.166.142.21:443 tsY.bitbucket.com tcp
US 8.8.8.8:53 Khb.bitbucket.com udp
IE 185.166.142.21:443 Khb.bitbucket.com tcp
US 8.8.8.8:53 zmwSQ.bitbucket.com udp
IE 185.166.142.22:443 zmwSQ.bitbucket.com tcp
US 8.8.8.8:53 kqiBojm.bitbucket.com udp
IE 185.166.142.21:443 kqiBojm.bitbucket.com tcp
US 8.8.8.8:53 pEftuUJrb.bitbucket.com udp
IE 185.166.142.22:443 pEftuUJrb.bitbucket.com tcp
US 8.8.8.8:53 SIFETj.bitbucket.com udp
IE 185.166.142.23:443 SIFETj.bitbucket.com tcp
US 8.8.8.8:53 bvFWVo.bitbucket.com udp
IE 185.166.142.23:443 bvFWVo.bitbucket.com tcp
US 8.8.8.8:53 tvznkjQsyJh.bitbucket.com udp
IE 185.166.142.22:443 tvznkjQsyJh.bitbucket.com tcp
US 8.8.8.8:53 IVhS.bitbucket.com udp
IE 185.166.142.21:443 IVhS.bitbucket.com tcp
US 8.8.8.8:53 AqP.bitbucket.com udp
IE 185.166.142.21:443 AqP.bitbucket.com tcp
US 8.8.8.8:53 tCnPQARvsqR.bitbucket.com udp
IE 185.166.142.21:443 tCnPQARvsqR.bitbucket.com tcp
US 8.8.8.8:53 KTlhhQss.bitbucket.com udp
IE 185.166.142.21:443 KTlhhQss.bitbucket.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 55a68eeb0b38857b50dff4d3c5181841
SHA1 0fa6fda712e0aeed2bea753e605aab34758ee159
SHA256 e22ca0a13b3b777eeefc50a5f5782e1e87e1003b4001a6d516ef2f6fcb87b58e
SHA512 75d4f34ea31c865d1dffff3a4065d1b23aa36619e0bf662a69174d20af3fa8a9a5bf15342bce5fb431dd46cc064fed63999cd445669f4939681ab167571e2f18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d434827eabff3a039ec89925b3a9b0f
SHA1 3284d95a177b1874017ee80eb406fee52ec614ed
SHA256 afd3e8effd156947a79433baf94246edce93d1a0dce6a7c8918974541147acd3
SHA512 cef4f55372688908bd03e7caa0152a74c489329cd6534de9a7d1db167e4f1683e36eff6a360e174b3da6a5d40847b18a0344d0117c6a789f1926b5dd4827c2ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7faf585b3cf611f8417ea775bfed375c
SHA1 2ac346993341ab75286f5f5a4f626cc4681619ea
SHA256 ad15f25b374e574cf97e47c2361c2e66b4f402456210dde69e289326174c7bc2
SHA512 99b45a36e520f686461eb11fa57d8deb19231f263c37a6e917a768ed69d457b98067faba24efe8ee3c25da31ba0514c78908cf0e7d874aea204d1d07eca98589

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a472b4fe20a4e4b48ec139787435fe55
SHA1 e457fe4b3f1cdd78ebf34def0ddb5602d4e0139d
SHA256 237e2712240fbd0f359e72dc4d1b9bd7660fc947ca17cb00da5823cac1a37779
SHA512 a6ea5a1d7f0bf6eed346893abe0ac05ac9f88b8aca48a0e40acb56d8899f11e80fe0fa96d1d2664f34e9abd5f09dcd0549f185bbad477ad57dbb131fb109de79

C:\Users\Admin\AppData\Local\Temp\TarB81E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabB77F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.exe

MD5 7a6349bb5bd595bbfb2f25e492d92e46
SHA1 36bcc7cb81fb65427e5e828c17d2f2d54faf872e
SHA256 4f7f8843f21ae391fa3ca58c105cbcdccc81c5420ef36f89dc50f2666bf5e8d0
SHA512 65b19c09d9b95a29cbf623a4e89c512fa742d43108d1177b750ddd96e45138feee8ed237f9ef917ea5a73301b80ff8fc792c6c8585c28f369384ab362ad78a24

memory/1520-1-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53e2c2556bf0d01d4f982d92eac9e129
SHA1 b87a835eac34048279ada0da572cc30f3bccc1cb
SHA256 01a810fc1a19cfa2d9bed235655c8e3a432a3caba6f36d645e39e8ee1dbd6a3d
SHA512 faf644b2b8253a067ecdcb3b63ba689ba36be8502f16ff3a5998cd2b7ef27f657e931ea786065b2a61b2ed36c4321d11e9a5729bbd733d6dbb2b654755085895

memory/1520-1299-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-1304-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-2929-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-3882-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-4805-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-5776-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-6629-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1520-6634-0x00000000002C0000-0x00000000003C0000-memory.dmp

memory/1520-6636-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/1520-6639-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/1520-6642-0x00000000003F0000-0x0000000000400000-memory.dmp

memory/1520-6647-0x0000000000401000-0x00000000010B5000-memory.dmp

memory/1520-6645-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-6649-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/1520-6650-0x0000000000401000-0x00000000010B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-13 18:36

Reported

2024-08-13 18:39

Platform

win10v2004-20240802-en

Max time kernel

125s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe"

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Cobaltstrike

trojan backdoor cobaltstrike

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hmTdtGd = "c:\\Windows\\System32\\hmTdtGd.exe" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A bitbucket.org N/A N/A
N/A bitbucket.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\Windows\System32\hmTdtGd.exe C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2native.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ADALPREVIOUS.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\SelectFind.kix C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OLKFSTUB.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\GFX.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\IMCONTACT.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\InvokeRestart.png C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mk.txt C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\upe.dll C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.SRnYYiaWCY.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.DpxjdEjfAt.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.szrAfLROrn.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.AOSymbyCMl.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.GnfEAxieXz.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.IGdAqtyuWq.com" C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe

"C:\Users\Admin\AppData\Local\Temp\2024-08-13_c861a8586ed22960cc5052cdf9534a10_cobalt-strike_cobaltstrike.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 xfmumrEUNqwGt.NfsLOTASDSKpwtyRerWa.readme.io udp
US 8.8.8.8:53 enmfwpb224ioj.x.pipedream.net udp
US 8.8.8.8:53 abrakadabra.host udp
US 18.204.193.192:443 enmfwpb224ioj.x.pipedream.net tcp
US 18.204.193.192:443 enmfwpb224ioj.x.pipedream.net tcp
US 18.204.193.192:443 enmfwpb224ioj.x.pipedream.net tcp
US 104.16.241.118:443 xfmumrEUNqwGt.NfsLOTASDSKpwtyRerWa.readme.io tcp
US 8.8.8.8:53 r.tPwrOJsmbPwZPxQUdGtx.readme.io udp
US 104.16.242.118:443 r.tPwrOJsmbPwZPxQUdGtx.readme.io tcp
US 8.8.8.8:53 118.241.16.104.in-addr.arpa udp
US 8.8.8.8:53 192.193.204.18.in-addr.arpa udp
US 8.8.8.8:53 118.242.16.104.in-addr.arpa udp
US 8.8.8.8:53 6.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 CM.HlUysdoEBUZRHBWOCali.readme.io udp
US 104.16.241.118:443 CM.HlUysdoEBUZRHBWOCali.readme.io tcp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 KwkkDmDSRKAr.bitbucket.com udp
IE 185.166.142.21:443 KwkkDmDSRKAr.bitbucket.com tcp
US 8.8.8.8:53 bitbucket.org udp
IE 185.166.142.22:443 bitbucket.org tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 21.142.166.185.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.142.166.185.in-addr.arpa udp
US 8.8.8.8:53 ivTgpp.bitbucket.com udp
IE 185.166.142.23:443 ivTgpp.bitbucket.com tcp
US 8.8.8.8:53 eMCeDKCBmh.bitbucket.com udp
IE 185.166.142.21:443 eMCeDKCBmh.bitbucket.com tcp
US 8.8.8.8:53 23.142.166.185.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 enwZRGceBCBR.wamzakxEgxCRYmWwBEKu.readme.io udp
US 104.16.241.118:443 enwZRGceBCBR.wamzakxEgxCRYmWwBEKu.readme.io tcp
US 8.8.8.8:53 hdt.aMSSDLFOOZnrMalGnhKF.readme.io udp
US 104.16.241.118:443 hdt.aMSSDLFOOZnrMalGnhKF.readme.io tcp
US 8.8.8.8:53 www.dropbox.com udp
GB 162.125.64.18:443 www.dropbox.com tcp
US 8.8.8.8:53 18.64.125.162.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.145.5:443 mega.nz tcp
US 8.8.8.8:53 5.145.216.31.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
LU 31.216.145.5:443 mega.nz tcp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 www.jmxyc.com udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 codeload.github.com udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 216.156.26.20.in-addr.arpa udp
LU 31.216.145.5:443 mega.nz tcp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 fKnRZmVCZvgh.bitbucket.com udp
IE 185.166.142.22:443 fKnRZmVCZvgh.bitbucket.com tcp
US 8.8.8.8:53 WAhlXGMNR.bitbucket.com udp
IE 185.166.142.21:443 WAhlXGMNR.bitbucket.com tcp
US 8.8.8.8:53 iqSAhkiHwiZH.bitbucket.com udp
IE 185.166.142.23:443 iqSAhkiHwiZH.bitbucket.com tcp
US 8.8.8.8:53 BITBXu.bitbucket.com udp
IE 185.166.142.23:443 BITBXu.bitbucket.com tcp
US 8.8.8.8:53 wZ.bitbucket.com udp
IE 185.166.142.21:443 wZ.bitbucket.com tcp
US 8.8.8.8:53 RI.bitbucket.com udp
IE 185.166.142.21:443 RI.bitbucket.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/4952-0-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-1-0x00000000001F0000-0x0000000000200000-memory.dmp

C:\Program Files\7-Zip\7-zip.dll.exe

MD5 26d2c44858b4b124420f87756d6889f4
SHA1 e48cbf1967e24851ad8f7957a5c54af22fa474c6
SHA256 39e5479638357266c5c5d1aecd57283cc7e12f82908da26fc2c90b2231da5dc8
SHA512 24a199183609638635e191a70695e2cd4f6614e0cf9fdcf18a42df0b9590d18b8151cb6efe0df66bafe9ac19c97a032660a67bbba94d46d5340dbdd86e5490dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 8c37b529d6a19fd50c9ba2373383be28
SHA1 ff592d3449822182dc0b24d7182bfdd4c64a679c
SHA256 f7100ab3048e46cfa79b4d007a22347da25fb4deef30b43f7fbbef3e3d7ed6f1
SHA512 02feb785e4b4e0897da98d4456710c300ef16578908f12945bf83a4feee1910026c0be98855572b51c7a9cf4f0f253978dc89ee19bfab70b57e890527c5d8261

memory/4952-691-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-1819-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-2369-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-2866-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-3949-0x0000000000400000-0x00000000010B6000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 dbd11cd09938374172e48d6808096c1f
SHA1 3cf8286f5985b2bf077d337708f6556c814570f6
SHA256 d1303f1be227182282ab3b15ad0baa7128fc1a88e90407d1829f47b044dd3e93
SHA512 d16fc76a9604955241973b1a5e8224243f8d566c78996960c5cf376704e27f159a79a463fc0d3f3317b553c5c6521f9879798d9cd49c5c46e819c031b00a1015

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 a856cb8e9b57a764bc8abac91a6d3990
SHA1 e701e08ca8b67e75611e3cd4253a6aa083a4c15f
SHA256 35eb9cc81c8ed393d9e6c7cee5131cb4cdb0c149757362c85e358b84a4f76ff5
SHA512 d3f7d39ab37ae089631c6a383591b071729bd8f373ff19ce6960c59e68c9e5899c9955174ef75171ddce3c8caf0e41e3c18acd42e301e5dc3449ed78de90819d

memory/4952-4367-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-4522-0x0000000000060000-0x0000000000062000-memory.dmp

memory/4952-4544-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/4952-4545-0x0000000000401000-0x00000000010B5000-memory.dmp

memory/4952-4546-0x0000000000400000-0x00000000010B6000-memory.dmp