Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1623897
MD5:	e3a004b573f3b6a8e32a6cf74e63c9d2
SHA1:	8e0bf5d952f7295996c577d0018eda13b13dd5e2
SHA256:	2b4a222f385c2367518a3c8d5794219af21376850133208b63c0914e89527e59
Tags:	CobaltStrikeexex64user-jstrosch
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Powershell download and execute

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found API chain indicative of debugger detection

Found potential dummy code loops (likely to delay analysis)

Joe Sandbox ML detected suspicious sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7360 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E3A004B573F3B6A8E32A6CF74E63C9D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 444, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "20.74.209.192,/updates.rss", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 318104477, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x36993:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36a0b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x37170:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x374a2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x37434:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x374a2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x36a6e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36bff:$a7: could not run command (w/ token) because of its length of %d bytes! 0x36ab4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36af2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x374ec:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x36d5a:$a11: Could not open service control manager on %s: %d 0x3728c:$a12: %d is an x64 process (can't inject x86 content) 0x372bc:$a13: %d is an x86 process (can't inject x64 content) 0x375dd:$a14: Failed to impersonate logged on user %d (%u) 0x37245:$a15: could not create remote thread in %d: %d 0x36b28:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x371f3:$a17: could not write to process memory: %d 0x36d8b:$a18: Could not create service %s on %s: %d 0x36e14:$a19: Could not delete service %s on %s: %d 0x36c79:$a20: Could not open process token: %d (%u)
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x21c90:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1c035:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 41 8B 84 24 98 00 00 00 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x374a2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x374ec:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x372bc:$x3: %d is an x86 process (can't inject x64 content) 0x36c79:$s1: Could not open process token: %d (%u) 0x36993:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36d37:$s4: Could not connect to pipe (%s): %d
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x45e61:$loader_export: ReflectiveLoader 0x36950:$exportname: beacon.dll
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3728c:$x2: %d is an x64 process (can't inject x86 content) 0x375dd:$x3: Failed to impersonate logged on user %d (%u) 0x374ec:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x374a2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x36bff:$s3: could not run command (w/ token) because of its length of %d bytes! 0x371f3:$s4: could not write to process memory: %d 0x36993:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36d37:$s6: Could not connect to pipe (%s): %d
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x37960:$str1: %s (admin) 0x36950:$str2: beacon.dll
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x374ec:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x372bc:$x2: %d is an x86 process (can't inject x64 content) 0x374a2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x37586:$x4: Failed to impersonate token from %d (%u) 0x375dd:$x5: Failed to impersonate logged on user %d (%u) 0x36993:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3747a:$s1: %%IMPORT%% 0x36977:$s2: www6.%x%x.%s 0x3696b:$s3: cdn.%x%x.%s 0x36bf3:$s4: api.%x%x.%s 0x37960:$s5: %s (admin) 0x36c62:$s6: could not spawn %s: %d 0x3751e:$s7: Could not kill %d: %d 0x36d37:$s8: Could not connect to pipe (%s): %d 0x36984:$s9: %s.1%x.%x%x.%s 0x36993:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36a0b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36a6e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36ab4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36af2:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x36b28:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36b51:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36b76:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x36b97:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x36bb4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x36bcd:$s9: %s.1%08x%08x.%x%x.%s 0x36be2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x35393:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3540b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35b70:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x35ea2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35e34:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x35ea2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3546e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x355ff:$a7: could not run command (w/ token) because of its length of %d bytes! 0x354b4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354f2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x35eec:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3575a:$a11: Could not open service control manager on %s: %d 0x35c8c:$a12: %d is an x64 process (can't inject x86 content) 0x35cbc:$a13: %d is an x86 process (can't inject x64 content) 0x35fdd:$a14: Failed to impersonate logged on user %d (%u) 0x35c45:$a15: could not create remote thread in %d: %d 0x35528:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35bf3:$a17: could not write to process memory: %d 0x3578b:$a18: Could not create service %s on %s: %d 0x35814:$a19: Could not delete service %s on %s: %d 0x35679:$a20: Could not open process token: %d (%u)
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x21090:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1b435:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 41 8B 84 24 98 00 00 00 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x35ea2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35eec:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x35cbc:$x3: %d is an x86 process (can't inject x64 content) 0x35679:$s1: Could not open process token: %d (%u) 0x35393:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35737:$s4: Could not connect to pipe (%s): %d
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x44861:$loader_export: ReflectiveLoader 0x35350:$exportname: beacon.dll
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x35c8c:$x2: %d is an x64 process (can't inject x86 content) 0x35fdd:$x3: Failed to impersonate logged on user %d (%u) 0x35eec:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x35ea2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x355ff:$s3: could not run command (w/ token) because of its length of %d bytes! 0x35bf3:$s4: could not write to process memory: %d 0x35393:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35737:$s6: Could not connect to pipe (%s): %d
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x36360:$str1: %s (admin) 0x35350:$str2: beacon.dll
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x35eec:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x35cbc:$x2: %d is an x86 process (can't inject x64 content) 0x35ea2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35f86:$x4: Failed to impersonate token from %d (%u) 0x35fdd:$x5: Failed to impersonate logged on user %d (%u) 0x35393:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x35e7a:$s1: %%IMPORT%% 0x35377:$s2: www6.%x%x.%s 0x3536b:$s3: cdn.%x%x.%s 0x355f3:$s4: api.%x%x.%s 0x36360:$s5: %s (admin) 0x35662:$s6: could not spawn %s: %d 0x35f1e:$s7: Could not kill %d: %d 0x35737:$s8: Could not connect to pipe (%s): %d 0x35384:$s9: %s.1%x.%x%x.%s 0x35393:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3540b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3546e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354b4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354f2:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x35528:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35551:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35576:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x35597:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x355b4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x355cd:$s9: %s.1%08x%08x.%x%x.%s 0x355e2:$s9: %s.1%08x.%x%x.%s
Process Memory Space: file.exe PID: 7360	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: file.exe PID: 7360	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: file.exe PID: 7360	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7360	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: file.exe PID: 7360	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: file.exe PID: 7360	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2de24:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x42b11:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2de9c:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x42b89:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2e601:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x432ee:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2e929:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x43616:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2e8bb:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2e929:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x435a8:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x43616:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2deff:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x42bec:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2e090:$a7: could not run command (w/ token) because of its length of %d bytes! 0x42d7d:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2df45:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x42c32:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2df83:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x42c70:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2e973:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: file.exe PID: 7360	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x32f9c:$loader_export: ReflectiveLoader 0x32fbb:$loader_export: ReflectiveLoader 0x47c89:$loader_export: ReflectiveLoader 0x47ca8:$loader_export: ReflectiveLoader 0x2dc76:$exportname: beacon.dll 0x2ddeb:$exportname: beacon.dll 0x42963:$exportname: beacon.dll 0x42ad8:$exportname: beacon.dll
Process Memory Space: file.exe PID: 7360	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2e973:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x43660:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2e74d:$x2: %d is an x86 process (can't inject x64 content) 0x4343a:$x2: %d is an x86 process (can't inject x64 content) 0x2e929:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x43616:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ea0d:$x4: Failed to impersonate token from %d (%u) 0x436fa:$x4: Failed to impersonate token from %d (%u) 0x2ea64:$x5: Failed to impersonate logged on user %d (%u) 0x43751:$x5: Failed to impersonate logged on user %d (%u) 0x2de24:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x42b11:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.400000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x35393:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3540b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35b70:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x35ea2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35e34:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x35ea2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3546e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x355ff:$a7: could not run command (w/ token) because of its length of %d bytes! 0x354b4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354f2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x35eec:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3575a:$a11: Could not open service control manager on %s: %d 0x35c8c:$a12: %d is an x64 process (can't inject x86 content) 0x35cbc:$a13: %d is an x86 process (can't inject x64 content) 0x35fdd:$a14: Failed to impersonate logged on user %d (%u) 0x35c45:$a15: could not create remote thread in %d: %d 0x35528:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35bf3:$a17: could not write to process memory: %d 0x3578b:$a18: Could not create service %s on %s: %d 0x35814:$a19: Could not delete service %s on %s: %d 0x35679:$a20: Could not open process token: %d (%u)
0.2.file.exe.a30000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x21090:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.file.exe.a30000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1b435:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 41 8B 84 24 98 00 00 00 25 FF FF FF 00 3D 42 42 42 00 75
0.2.file.exe.a30000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x35ea2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35eec:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x35cbc:$x3: %d is an x86 process (can't inject x64 content) 0x35679:$s1: Could not open process token: %d (%u) 0x35393:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35737:$s4: Could not connect to pipe (%s): %d
0.2.file.exe.a30000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x44861:$loader_export: ReflectiveLoader 0x35350:$exportname: beacon.dll
0.2.file.exe.a30000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x35c8c:$x2: %d is an x64 process (can't inject x86 content) 0x35fdd:$x3: Failed to impersonate logged on user %d (%u) 0x35eec:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x35ea2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x355ff:$s3: could not run command (w/ token) because of its length of %d bytes! 0x35bf3:$s4: could not write to process memory: %d 0x35393:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35737:$s6: Could not connect to pipe (%s): %d
0.2.file.exe.a30000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x36360:$str1: %s (admin) 0x35350:$str2: beacon.dll
0.2.file.exe.a30000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x35eec:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x35cbc:$x2: %d is an x86 process (can't inject x64 content) 0x35ea2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35f86:$x4: Failed to impersonate token from %d (%u) 0x35fdd:$x5: Failed to impersonate logged on user %d (%u) 0x35393:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.file.exe.a30000.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.file.exe.a30000.1.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x35e7a:$s1: %%IMPORT%% 0x35377:$s2: www6.%x%x.%s 0x3536b:$s3: cdn.%x%x.%s 0x355f3:$s4: api.%x%x.%s 0x36360:$s5: %s (admin) 0x35662:$s6: could not spawn %s: %d 0x35f1e:$s7: Could not kill %d: %d 0x35737:$s8: Could not connect to pipe (%s): %d 0x35384:$s9: %s.1%x.%x%x.%s 0x35393:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3540b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3546e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354b4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354f2:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x35528:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35551:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35576:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x35597:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x355b4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x355cd:$s9: %s.1%08x%08x.%x%x.%s 0x355e2:$s9: %s.1%08x.%x%x.%s
0.2.file.exe.a90000.2.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a90000.2.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a90000.2.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x36993:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36a0b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x37170:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x374a2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x37434:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x374a2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x36a6e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36bff:$a7: could not run command (w/ token) because of its length of %d bytes! 0x36ab4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36af2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x374ec:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x36d5a:$a11: Could not open service control manager on %s: %d 0x3728c:$a12: %d is an x64 process (can't inject x86 content) 0x372bc:$a13: %d is an x86 process (can't inject x64 content) 0x375dd:$a14: Failed to impersonate logged on user %d (%u) 0x37245:$a15: could not create remote thread in %d: %d 0x36b28:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x371f3:$a17: could not write to process memory: %d 0x36d8b:$a18: Could not create service %s on %s: %d 0x36e14:$a19: Could not delete service %s on %s: %d 0x36c79:$a20: Could not open process token: %d (%u)
0.2.file.exe.a90000.2.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x21c90:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.file.exe.a90000.2.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1c035:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 41 8B 84 24 98 00 00 00 25 FF FF FF 00 3D 42 42 42 00 75
0.2.file.exe.a90000.2.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x374a2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x374ec:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x372bc:$x3: %d is an x86 process (can't inject x64 content) 0x36c79:$s1: Could not open process token: %d (%u) 0x36993:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36d37:$s4: Could not connect to pipe (%s): %d
0.2.file.exe.a90000.2.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x45e61:$loader_export: ReflectiveLoader 0x36950:$exportname: beacon.dll
0.2.file.exe.a90000.2.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3728c:$x2: %d is an x64 process (can't inject x86 content) 0x375dd:$x3: Failed to impersonate logged on user %d (%u) 0x374ec:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x374a2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x36bff:$s3: could not run command (w/ token) because of its length of %d bytes! 0x371f3:$s4: could not write to process memory: %d 0x36993:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36d37:$s6: Could not connect to pipe (%s): %d
0.2.file.exe.a90000.2.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x37960:$str1: %s (admin) 0x36950:$str2: beacon.dll
0.2.file.exe.a90000.2.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x374ec:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x372bc:$x2: %d is an x86 process (can't inject x64 content) 0x374a2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x37586:$x4: Failed to impersonate token from %d (%u) 0x375dd:$x5: Failed to impersonate logged on user %d (%u) 0x36993:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.file.exe.a90000.2.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3747a:$s1: %%IMPORT%% 0x36977:$s2: www6.%x%x.%s 0x3696b:$s3: cdn.%x%x.%s 0x36bf3:$s4: api.%x%x.%s 0x37960:$s5: %s (admin) 0x36c62:$s6: could not spawn %s: %d 0x3751e:$s7: Could not kill %d: %d 0x36d37:$s8: Could not connect to pipe (%s): %d 0x36984:$s9: %s.1%x.%x%x.%s 0x36993:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36a0b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36a6e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36ab4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36af2:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x36b28:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36b51:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36b76:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x36b97:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x36bb4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x36bcd:$s9: %s.1%08x%08x.%x%x.%s 0x36be2:$s9: %s.1%08x.%x%x.%s
0.2.file.exe.a30000.1.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a30000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x34793:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3480b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3486e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x348b4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x348f2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x34928:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x34550:$a39: %s as %s\%s: %d 0x34784:$a40: %s.1%x.%x%x.%s 0x43252:$a41: beacon.x64.dll 0x34777:$a43: www6.%x%x.%s 0x3476b:$a44: cdn.%x%x.%s 0x34d60:$a46: %s (admin) 0x34750:$a47: beacon.dll 0x346c0:$a48: %s%s: %s 0x3457c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x345a8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x34dc9:$a51: Content-Length: %d
0.2.file.exe.a30000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x20490:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.file.exe.a30000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1a835:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 41 8B 84 24 98 00 00 00 25 FF FF FF 00 3D 42 42 42 00 75
0.2.file.exe.a30000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x43261:$loader_export: ReflectiveLoader 0x34750:$exportname: beacon.dll
0.2.file.exe.a30000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x34d60:$str1: %s (admin) 0x34750:$str2: beacon.dll
0.2.file.exe.a30000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x34793:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.file.exe.a30000.1.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x34777:$s2: www6.%x%x.%s 0x3476b:$s3: cdn.%x%x.%s 0x34d60:$s5: %s (admin) 0x34784:$s9: %s.1%x.%x%x.%s 0x34793:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3480b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3486e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x348b4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x348f2:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x34928:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.file.exe.a90000.2.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a90000.2.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.file.exe.a90000.2.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x35393:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3540b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35b70:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x35ea2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35e34:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x35ea2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3546e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x355ff:$a7: could not run command (w/ token) because of its length of %d bytes! 0x354b4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354f2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x35eec:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3575a:$a11: Could not open service control manager on %s: %d 0x35c8c:$a12: %d is an x64 process (can't inject x86 content) 0x35cbc:$a13: %d is an x86 process (can't inject x64 content) 0x35fdd:$a14: Failed to impersonate logged on user %d (%u) 0x35c45:$a15: could not create remote thread in %d: %d 0x35528:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35bf3:$a17: could not write to process memory: %d 0x3578b:$a18: Could not create service %s on %s: %d 0x35814:$a19: Could not delete service %s on %s: %d 0x35679:$a20: Could not open process token: %d (%u)
0.2.file.exe.a90000.2.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x21090:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.file.exe.a90000.2.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1b435:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 41 8B 84 24 98 00 00 00 25 FF FF FF 00 3D 42 42 42 00 75
0.2.file.exe.a90000.2.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x35ea2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35eec:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x35cbc:$x3: %d is an x86 process (can't inject x64 content) 0x35679:$s1: Could not open process token: %d (%u) 0x35393:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35737:$s4: Could not connect to pipe (%s): %d
0.2.file.exe.a90000.2.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x44861:$loader_export: ReflectiveLoader 0x35350:$exportname: beacon.dll
0.2.file.exe.a90000.2.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x35c8c:$x2: %d is an x64 process (can't inject x86 content) 0x35fdd:$x3: Failed to impersonate logged on user %d (%u) 0x35eec:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x35ea2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x355ff:$s3: could not run command (w/ token) because of its length of %d bytes! 0x35bf3:$s4: could not write to process memory: %d 0x35393:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35737:$s6: Could not connect to pipe (%s): %d
0.2.file.exe.a90000.2.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x36360:$str1: %s (admin) 0x35350:$str2: beacon.dll
0.2.file.exe.a90000.2.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x35eec:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x35cbc:$x2: %d is an x86 process (can't inject x64 content) 0x35ea2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x35f86:$x4: Failed to impersonate token from %d (%u) 0x35fdd:$x5: Failed to impersonate logged on user %d (%u) 0x35393:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.file.exe.a90000.2.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.file.exe.a90000.2.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x35e7a:$s1: %%IMPORT%% 0x35377:$s2: www6.%x%x.%s 0x3536b:$s3: cdn.%x%x.%s 0x355f3:$s4: api.%x%x.%s 0x36360:$s5: %s (admin) 0x35662:$s6: could not spawn %s: %d 0x35f1e:$s7: Could not kill %d: %d 0x35737:$s8: Could not connect to pipe (%s): %d 0x35384:$s9: %s.1%x.%x%x.%s 0x35393:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3540b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3546e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354b4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x354f2:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x35528:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35551:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x35576:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x35597:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x355b4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x355cd:$s9: %s.1%08x%08x.%x%x.%s 0x355e2:$s9: %s.1%08x.%x%x.%s
Click to see the 45 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-25T17:19:35.895105+0100	2028765	3	Unknown Traffic	192.168.2.7	49700	20.74.209.192	444	TCP
2025-02-25T17:19:39.891078+0100	2028765	3	Unknown Traffic	192.168.2.7	49703	20.74.209.192	444	TCP
2025-02-25T17:19:43.954377+0100	2028765	3	Unknown Traffic	192.168.2.7	49707	20.74.209.192	444	TCP
2025-02-25T17:19:47.978685+0100	2028765	3	Unknown Traffic	192.168.2.7	49735	20.74.209.192	444	TCP
2025-02-25T17:19:52.236582+0100	2028765	3	Unknown Traffic	192.168.2.7	49766	20.74.209.192	444	TCP
2025-02-25T17:19:56.290579+0100	2028765	3	Unknown Traffic	192.168.2.7	49795	20.74.209.192	444	TCP
2025-02-25T17:20:00.324031+0100	2028765	3	Unknown Traffic	192.168.2.7	49825	20.74.209.192	444	TCP
2025-02-25T17:20:04.448412+0100	2028765	3	Unknown Traffic	192.168.2.7	49853	20.74.209.192	444	TCP
2025-02-25T17:20:08.889698+0100	2028765	3	Unknown Traffic	192.168.2.7	49881	20.74.209.192	444	TCP
2025-02-25T17:20:12.977911+0100	2028765	3	Unknown Traffic	192.168.2.7	49913	20.74.209.192	444	TCP
2025-02-25T17:20:17.010810+0100	2028765	3	Unknown Traffic	192.168.2.7	49941	20.74.209.192	444	TCP
2025-02-25T17:20:21.043682+0100	2028765	3	Unknown Traffic	192.168.2.7	64380	20.74.209.192	444	TCP
2025-02-25T17:20:25.258899+0100	2028765	3	Unknown Traffic	192.168.2.7	64409	20.74.209.192	444	TCP
2025-02-25T17:20:29.275334+0100	2028765	3	Unknown Traffic	192.168.2.7	64417	20.74.209.192	444	TCP
2025-02-25T17:20:33.320794+0100	2028765	3	Unknown Traffic	192.168.2.7	64420	20.74.209.192	444	TCP
2025-02-25T17:20:37.424151+0100	2028765	3	Unknown Traffic	192.168.2.7	64423	20.74.209.192	444	TCP
2025-02-25T17:20:41.543097+0100	2028765	3	Unknown Traffic	192.168.2.7	64426	20.74.209.192	444	TCP
2025-02-25T17:20:45.589275+0100	2028765	3	Unknown Traffic	192.168.2.7	64429	20.74.209.192	444	TCP
2025-02-25T17:20:49.668849+0100	2028765	3	Unknown Traffic	192.168.2.7	64432	20.74.209.192	444	TCP
2025-02-25T17:20:53.697999+0100	2028765	3	Unknown Traffic	192.168.2.7	64435	20.74.209.192	444	TCP
2025-02-25T17:20:57.932094+0100	2028765	3	Unknown Traffic	192.168.2.7	64438	20.74.209.192	444	TCP
2025-02-25T17:21:02.181005+0100	2028765	3	Unknown Traffic	192.168.2.7	64441	20.74.209.192	444	TCP
2025-02-25T17:21:06.419029+0100	2028765	3	Unknown Traffic	192.168.2.7	64444	20.74.209.192	444	TCP
2025-02-25T17:21:10.885651+0100	2028765	3	Unknown Traffic	192.168.2.7	64447	20.74.209.192	444	TCP
2025-02-25T17:21:14.915199+0100	2028765	3	Unknown Traffic	192.168.2.7	64450	20.74.209.192	444	TCP
2025-02-25T17:21:18.964082+0100	2028765	3	Unknown Traffic	192.168.2.7	64453	20.74.209.192	444	TCP
2025-02-25T17:21:23.057544+0100	2028765	3	Unknown Traffic	192.168.2.7	64456	20.74.209.192	444	TCP
2025-02-25T17:21:27.073568+0100	2028765	3	Unknown Traffic	192.168.2.7	64459	20.74.209.192	444	TCP
2025-02-25T17:21:31.073068+0100	2028765	3	Unknown Traffic	192.168.2.7	64462	20.74.209.192	444	TCP
2025-02-25T17:21:35.105004+0100	2028765	3	Unknown Traffic	192.168.2.7	64465	20.74.209.192	444	TCP
2025-02-25T17:21:39.263374+0100	2028765	3	Unknown Traffic	192.168.2.7	64468	20.74.209.192	444	TCP
2025-02-25T17:21:43.294049+0100	2028765	3	Unknown Traffic	192.168.2.7	64471	20.74.209.192	444	TCP
2025-02-25T17:21:47.463059+0100	2028765	3	Unknown Traffic	192.168.2.7	64474	20.74.209.192	444	TCP
2025-02-25T17:21:51.462966+0100	2028765	3	Unknown Traffic	192.168.2.7	64477	20.74.209.192	444	TCP
2025-02-25T17:21:55.431658+0100	2028765	3	Unknown Traffic	192.168.2.7	64480	20.74.209.192	444	TCP
2025-02-25T17:21:59.448684+0100	2028765	3	Unknown Traffic	192.168.2.7	64483	20.74.209.192	444	TCP
2025-02-25T17:22:03.528761+0100	2028765	3	Unknown Traffic	192.168.2.7	64486	20.74.209.192	444	TCP
2025-02-25T17:22:07.541915+0100	2028765	3	Unknown Traffic	192.168.2.7	64489	20.74.209.192	444	TCP
2025-02-25T17:22:11.573763+0100	2028765	3	Unknown Traffic	192.168.2.7	64492	20.74.209.192	444	TCP
2025-02-25T17:22:15.605915+0100	2028765	3	Unknown Traffic	192.168.2.7	64495	20.74.209.192	444	TCP
2025-02-25T17:22:19.634701+0100	2028765	3	Unknown Traffic	192.168.2.7	64498	20.74.209.192	444	TCP
2025-02-25T17:22:23.887224+0100	2028765	3	Unknown Traffic	192.168.2.7	64501	20.74.209.192	444	TCP
2025-02-25T17:22:27.928419+0100	2028765	3	Unknown Traffic	192.168.2.7	64504	20.74.209.192	444	TCP
2025-02-25T17:22:31.999062+0100	2028765	3	Unknown Traffic	192.168.2.7	64507	20.74.209.192	444	TCP
2025-02-25T17:22:36.036044+0100	2028765	3	Unknown Traffic	192.168.2.7	64510	20.74.209.192	444	TCP
2025-02-25T17:22:40.045331+0100	2028765	3	Unknown Traffic	192.168.2.7	64513	20.74.209.192	444	TCP
2025-02-25T17:22:44.091127+0100	2028765	3	Unknown Traffic	192.168.2.7	64516	20.74.209.192	444	TCP
2025-02-25T17:22:48.137956+0100	2028765	3	Unknown Traffic	192.168.2.7	64519	20.74.209.192	444	TCP
2025-02-25T17:22:52.246779+0100	2028765	3	Unknown Traffic	192.168.2.7	64522	20.74.209.192	444	TCP
2025-02-25T17:22:56.355103+0100	2028765	3	Unknown Traffic	192.168.2.7	64525	20.74.209.192	444	TCP
2025-02-25T17:23:00.387159+0100	2028765	3	Unknown Traffic	192.168.2.7	64528	20.74.209.192	444	TCP
2025-02-25T17:23:04.420528+0100	2028765	3	Unknown Traffic	192.168.2.7	64531	20.74.209.192	444	TCP
2025-02-25T17:23:08.420815+0100	2028765	3	Unknown Traffic	192.168.2.7	64534	20.74.209.192	444	TCP
2025-02-25T17:23:12.503169+0100	2028765	3	Unknown Traffic	192.168.2.7	64537	20.74.209.192	444	TCP
2025-02-25T17:23:16.495452+0100	2028765	3	Unknown Traffic	192.168.2.7	64540	20.74.209.192	444	TCP
2025-02-25T17:23:20.547122+0100	2028765	3	Unknown Traffic	192.168.2.7	64543	20.74.209.192	444	TCP
2025-02-25T17:23:24.577386+0100	2028765	3	Unknown Traffic	192.168.2.7	64546	20.74.209.192	444	TCP
2025-02-25T17:23:28.635169+0100	2028765	3	Unknown Traffic	192.168.2.7	64549	20.74.209.192	444	TCP
2025-02-25T17:23:32.671664+0100	2028765	3	Unknown Traffic	192.168.2.7	64552	20.74.209.192	444	TCP
2025-02-25T17:23:36.716192+0100	2028765	3	Unknown Traffic	192.168.2.7	64555	20.74.209.192	444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 444, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "20.74.209.192,/updates.rss", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 318104477, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 83%			Perma Link
Source: file.exe	ReversingLabs: Detection: 86%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A91184 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_00A91184

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA3B20 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00AA3B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AABC98 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_00AABC98

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 20.74.209.192

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 20.74.209.192:444

Source: global traffic

TCP traffic: 192.168.2.7:64353 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 20.74.209.192 20.74.209.192

Source: Joe Sandbox View

ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49700 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49703 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49707 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49735 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49766 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49795 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49825 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49853 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49881 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49913 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49941 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64380 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64417 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64420 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64409 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64426 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64423 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64429 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64438 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64432 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64441 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64450 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64456 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64459 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64453 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64465 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64462 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64471 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64468 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64474 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64477 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64483 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64480 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64489 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64498 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64444 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64501 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64435 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64492 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64504 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64507 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64516 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64522 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64519 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64525 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64528 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64537 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64543 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64534 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64447 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64552 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64555 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64486 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64540 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64513 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64546 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64531 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64549 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64495 -> 20.74.209.192:444
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:64510 -> 20.74.209.192:444

Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.209.192

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA0318 _snprintf,_snprintf,_snprintf,HttpOpenRequestA,HttpSendRequestA,InternetQueryDataAvailable,InternetCloseHandle,InternetReadFile,InternetCloseHandle,

0_2_00AA0318

Source: file.exe, 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384248122.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1405022219.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1426453259.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1303556511.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1364777586.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1447653763.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192/
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384248122.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1405022219.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1426453259.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1303556511.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1364777586.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1447653763.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192/;
Source: file.exe, 00000000.00000003.1384248122.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1303556511.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1364777586.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1344211554.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384424235.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1343804099.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1324145477.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192/o
Source: file.exe, 00000000.00000003.2355807803.000000000014E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1324145477.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1940682857.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919964890.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124856393.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960279813.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001232594.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104552769.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041645667.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/)d
Source: file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444//
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1426453259.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674553440.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1426854312.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/1e
Source: file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878250381.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757443023.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715028291.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817986661.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1714700662.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797376850.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/20
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878250381.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/209.192:444/
Source: file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/209.192:444/5/
Source: file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/209.192:444/9d
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253620833.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253880468.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124856393.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104552769.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294278387.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041645667.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210661642.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212088351.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/209.192:444/pdates.rss
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1940682857.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253620833.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253880468.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919964890.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/209.192:444/updates.rss
Source: file.exe, 00000000.00000003.2355807803.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/209.192:444/updates.rssad
Source: file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253620833.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253880468.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294278387.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210661642.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212088351.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/5/
Source: file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253620833.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253880468.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294278387.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210661642.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212088351.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/9d
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674553440.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634599084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1569716854.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878250381.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/Ad
Source: file.exe, 00000000.00000003.1405022219.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/Qd
Source: file.exe, 00000000.00000003.1467199619.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467558003.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507891892.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1447653763.0000000000149000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/Qg
Source: file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/S
Source: file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/Yd$
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878250381.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/Yg$
Source: file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/_
Source: file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/a
Source: file.exe, 00000000.00000003.1507891892.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/ae
Source: file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919916767.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817986661.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797376850.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1940682857.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/o
Source: file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878250381.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1940682857.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/pdates.rss
Source: file.exe, 00000000.00000002.3709866097.000000000014E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/pdates.rssyd
Source: file.exe, 00000000.00000003.2355807803.000000000014E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1324145477.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss
Source: file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2699191944.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507891892.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2619393287.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797376850.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss%~
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919916767.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817986661.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1940682857.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104552769.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss(
Source: file.exe, 00000000.00000003.2415595495.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1324145477.000000000014A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1343804099.000000000014A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634599084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1344263330.000000000014A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1364777586.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1569716854.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384248122.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2779948550.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384424235.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2375442389.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1614451350.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1589240884.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1589425126.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss.~
Source: file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1549193452.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041645667.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss1~
Source: file.exe, 00000000.00000003.3064924684.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3024672136.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss4~
Source: file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878250381.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2983362217.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1940682857.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919964890.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960279813.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1549193452.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817986661.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss7~
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124856393.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104552769.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss=~
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3709624199.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1589240884.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssF
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674553440.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssId
Source: file.exe, 00000000.00000002.3709624199.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssL
Source: file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674553440.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634599084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1569716854.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674772703.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757443023.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715028291.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1549193452.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817986661.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1614451350.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1714700662.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssQg
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253620833.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210661642.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104552769.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssR
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1447653763.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1589240884.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1714700662.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919916767.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssX
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384248122.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1405022219.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1426453259.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1364777586.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1447653763.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssb
Source: file.exe, 00000000.00000003.1384248122.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1364777586.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1344211554.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384424235.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1343804099.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1324145477.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssmui
Source: file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1405022219.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1426453259.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1447653763.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1507671346.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467199619.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssmui(
Source: file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2355807803.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3709624199.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssmuih
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2041409022.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757230911.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1548051388.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1589240884.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1714700662.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1899474923.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919916767.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssn
Source: file.exe, 00000000.00000002.3709358127.00000000000FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssr
Source: file.exe, 00000000.00000003.2125826358.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081782043.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2062212310.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2166903788.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674553440.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858506141.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2314872826.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082132459.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1960016913.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1919731532.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1735670165.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634599084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1878001612.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2315065289.000000000014D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rssyd
Source: file.exe, 00000000.00000003.1797616084.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1838015921.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3105085222.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189422108.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2860667309.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1837792556.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1777823088.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817986661.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210661642.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212088351.0000000000148000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1797376850.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/updates.rss~
Source: file.exe, 00000000.00000003.2166903788.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1634376076.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234089313.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1614451350.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2253620833.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147046630.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1655029615.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674553440.0000000000124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://20.74.209.192:444/w

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC6080 CreateProcessAsUserA,

0_2_00AC6080

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A54884	0_2_00A54884
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5709C	0_2_00A5709C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F0E8	0_2_00A4F0E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A498F4	0_2_00A498F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F8D8	0_2_00A4F8D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56078	0_2_00A56078
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A629D0	0_2_00A629D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E960	0_2_00A3E960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3916C	0_2_00A3916C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F2B8	0_2_00A4F2B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3DAF0	0_2_00A3DAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4221C	0_2_00A4221C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A60A50	0_2_00A60A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5FB80	0_2_00A5FB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A613C0	0_2_00A613C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4E3D0	0_2_00A4E3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A50304	0_2_00A50304
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3DC84	0_2_00A3DC84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A438	0_2_00A4A438
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53C40	0_2_00A53C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A59D44	0_2_00A59D44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A39680	0_2_00A39680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5EE80	0_2_00A5EE80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A506CC	0_2_00A506CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56634	0_2_00A56634
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F608	0_2_00A4F608
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A60767	0_2_00A60767
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9E884	0_2_00A9E884
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9E6F0	0_2_00A9E6F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAB038	0_2_00AAB038
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB4840	0_2_00AB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABA944	0_2_00ABA944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9A280	0_2_00A9A280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABFA80	0_2_00ABFA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB12CC	0_2_00AB12CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB7234	0_2_00AB7234
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB0208	0_2_00AB0208
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6260	0_2_00AC6260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6240	0_2_00AC6240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6320	0_2_00AC6320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC1367	0_2_00AC1367
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB5484	0_2_00AB5484
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB7C9C	0_2_00AB7C9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFCE8	0_2_00AAFCE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA4F4	0_2_00AAA4F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB04D8	0_2_00AB04D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB0C78	0_2_00AB0C78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB6C78	0_2_00AB6C78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9CD90	0_2_00A9CD90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1DC8	0_2_00AB1DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC35D0	0_2_00AC35D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A99D6C	0_2_00A99D6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9F560	0_2_00A9F560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFEB8	0_2_00AAFEB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA2E1C	0_2_00AA2E1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC1650	0_2_00AC1650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC0780	0_2_00AC0780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC1FC0	0_2_00AC1FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAEFD0	0_2_00AAEFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACA7D2	0_2_00ACA7D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB0F04	0_2_00AB0F04

Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6098 AdjustTokenPrivileges,		0_2_00AC6098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA2A58 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		0_2_00AA2A58

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAB998 GetCurrentProcess,CreateToolhelp32Snapshot,Process32First,ProcessIdToSessionId,Process32Next,

0_2_00AAB998

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 83%
Source: file.exe	ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABDB14 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00ABDB14

Source: file.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6BB5C push 0000006Ah; retf	0_2_00A6BB74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7821 pushfq ; ret	0_2_00AC7823
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACD15C push 0000006Ah; retf	0_2_00ACD174
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACAA98 push rax; retn 00ACh	0_2_00ACAA99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC77A0 push rdi; ret	0_2_00AC77A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACA740 push rax; retn 00ACh	0_2_00ACA741

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB4840 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00AB4840

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA8198		0_2_00AA8198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA1904		0_2_00AA1904

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 9363			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 516			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 6.9 %

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA1904

0_2_00AA1904

Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep count: 9363 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep time: -93630000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7416	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep count: 516 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep time: -5160000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA3B20 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00AA3B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AABC98 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_00AABC98

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: file.exe, 00000000.00000002.3709124454.00000000000CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000003.2124856393.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1488138869.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1384248122.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2274385808.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1528474940.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293920913.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1695341643.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1981125983.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2021921590.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2000941231.0000000000124000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335061965.0000000000124000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-41212
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-41077

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-40798

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC3BE0 MultiByteToWideChar,MultiByteToWideChar,DebuggerProbe,DebuggerRuntime,IsDebuggerPresent,_RTC_GetSrcLine,WideCharToMultiByte,WideCharToMultiByte,

0_2_00AC3BE0

Source: C:\Users\user\Desktop\file.exe

0_2_00ABDB14

Source: C:\Users\user\Desktop\file.exe

0_2_00ABDB14

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAA0AC InitializeProcThreadAttributeList,GetProcessHeap,HeapAlloc,InitializeProcThreadAttributeList,

0_2_00AAA0AC

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,	0_2_004011B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402F74 SetUnhandledExceptionFilter,	0_2_00402F74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401B30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045D2FC SetUnhandledExceptionFilter,	0_2_0045D2FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB6280 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AB6280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC64A8 SetUnhandledExceptionFilter,	0_2_00AC64A8

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB2308 LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_00AB2308

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB2280 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00AB2280

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A55DB4 cpuid

0_2_00A55DB4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401630 CreateNamedPipeA,ConnectNamedPipe,WriteFile,CloseHandle,

0_2_00401630

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401A50 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00401A50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA8768 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_00AA8768

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA8768 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_00AA8768

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: file.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: 0.2.file.exe.a30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a90000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a90000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3710494904.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3710436556.0000000000A30000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA902C htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_00AA902C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3320 socket,closesocket,htons,bind,listen,	0_2_00AB3320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9434 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_00AA9434

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	212 Virtualization/Sandbox Evasion	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	21 Access Token Manipulation	Security Account Manager	212 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	14 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
file.exe