Edit tour

Windows Analysis Report
1a#U77e5.exe

Overview

General Information

Sample Name:	1a#U77e5.exe
Analysis ID:	679126
MD5:	3f2202e24ad0a66c08f88a18dd7b5fb4
SHA1:	62df51eb1351279afa4dbe5920758d6974427ac9
SHA256:	eb94cd39cde6a5270181d6e6788c69a2a90ab2b27f9236c8382e810e4dfead1d
Tags:	exe
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Yara detected CobaltStrike

C2 URLs / IPs found in malware configuration

Potentially malicious time measurement code found

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality for execution timing, often used to detect debuggers

Found inlined nop instructions (likely shell or obfuscated code)

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

1a#U77e5.exe (PID: 5296 cmdline: "C:\Users\user\Desktop\1a#U77e5.exe" MD5: 3F2202E24AD0A66C08F88A18DD7B5FB4)

????????????.exe (PID: 3016 cmdline: C:\Windows\Temp\????????????.exe 9gb3vbgeng MD5: 84E3D79DA5E503374E61A17351781C14)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5788 cmdline: cmd.exe /c start ?????????????????????.docx MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WINWORD.EXE (PID: 5308 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\?????????????????????.docx" /o " MD5: 0B9AB9B9C4DE429473D6450D4297A123)

cleanup

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 1443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "124.221.206.154,/submit.php", "HttpPostUri": "/submit.jsp", "Malleable_C2_Instructions": [], "SpawnTo": "AAAAAAAAAAAAAAAAAAAAAA==", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 0, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.706923007.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	Cobaltbaltstrike_Beacon_Encoded	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$s10: TVpBUlVIieVIgewgAAAAS
00000003.00000002.705984762.000000C000174000.00000004.00001000.00020000.00000000.sdmp	Cobaltbaltstrike_Beacon_Encoded	Detects CobaltStrike payloads	Avast Threat Intel Team	0x10:$s10: TVpBUlVIieVIgewgAAAAS
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x3b3ae:$xs1: WS2_32.dll 0x3b8a1:$xs2: ReflectiveLoader
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	FireEye	0x17b4b:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 0F B6 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 0F F3 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF ... 0x16f0e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0x10a48:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	HKTL_CobaltStrike_SleepMask_Jul22	Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated	CodeX	0x1000:$sleep_mask: 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2c700:$a39: %s as %s\%s: %d 0x3b892:$a41: beacon.x64.dll 0x2d900:$a46: %s (admin) 0x2c860:$a48: %s%s: %s 0x2c72c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2c758:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2d949:$a51: Content-Length: %d
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x18fd8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x10ab5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c8a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x17f1b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000003.00000002.706488711.000000C00023E000.00000004.00001000.00020000.00000000.sdmp	Cobaltbaltstrike_Beacon_Encoded	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$s10: TVpBUlVIieVIgewgAAAAS
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x3a3ae:$xs1: WS2_32.dll 0x3a8a1:$xs2: ReflectiveLoader
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x3a8a1:$x1: ReflectiveLoader
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	Cobaltbaltstrike_Beacon_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 0x3aa30:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0xfe48:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x3aa30:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	CobaltStrike_MZ_Launcher	Detects CobaltStrike MZ header ReflectiveLoader launcher	yara@s3c.za.net	0x0:$mz_launcher: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	HKTL_CobaltStrike_SleepMask_Jul22	Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated	CodeX	0x400:$sleep_mask: 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3ad8e:$xo1: cATGBBO\x01\x1B\x1E
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b700:$a39: %s as %s\%s: %d 0x3a892:$a41: beacon.x64.dll 0x2c900:$a46: %s (admin) 0x2b860:$a48: %s%s: %s 0x2b72c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b758:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2c949:$a51: Content-Length: %d
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x183d8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xfeb5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1608a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1731b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x3a3ae:$xs1: WS2_32.dll 0x3a8a1:$xs2: ReflectiveLoader
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x3a8a1:$x1: ReflectiveLoader
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	Cobaltbaltstrike_Beacon_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 0x3aa30:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0xfe48:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x3aa30:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_MZ_Launcher	Detects CobaltStrike MZ header ReflectiveLoader launcher	yara@s3c.za.net	0x0:$mz_launcher: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	HKTL_CobaltStrike_SleepMask_Jul22	Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated	CodeX	0x400:$sleep_mask: 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3ad8e:$xo1: cATGBBO\x01\x1B\x1E
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b700:$a39: %s as %s\%s: %d 0x3a892:$a41: beacon.x64.dll 0x2c900:$a46: %s (admin) 0x2b860:$a48: %s%s: %s 0x2b72c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b758:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2c949:$a51: Content-Length: %d
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x183d8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xfeb5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1608a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1731b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: ????????????.exe PID: 3016	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x1c3cd9:$xs1: WS2_32.dll 0x1eb517:$xs1: WS2_32.dll 0x1c42b4:$xs2: ReflectiveLoader 0x1ebaf2:$xs2: ReflectiveLoader
Process Memory Space: ????????????.exe PID: 3016	Cobaltbaltstrike_Beacon_Encoded	Detects CobaltStrike payloads	Avast Threat Intel Team	0x2e:$s10: TVpBUlVIieVIgewgAAAAS 0x1655d6:$s10: TVpBUlVIieVIgewgAAAAS
Process Memory Space: ????????????.exe PID: 3016	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x1ebb24:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 20 2E 2D 2E 2C 2E 2A 2E 2E 20 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
Process Memory Space: ????????????.exe PID: 3016	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: ????????????.exe PID: 3016	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: ????????????.exe PID: 3016	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x1c0793:$a39: %s as %s\%s: %d 0x1e7fd1:$a39: %s as %s\%s: %d 0x1c42a5:$a41: beacon.x64.dll 0x1ebae3:$a41: beacon.x64.dll 0x1c0ade:$a46: %s (admin) 0x1e831c:$a46: %s (admin) 0x1c08a6:$a48: %s%s: %s 0x1e80e4:$a48: %s%s: %s 0x1c07ad:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1c07d6:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1c0930:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1e7feb:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1e8014:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1e816e:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1c0b22:$a51: Content-Length: %d 0x1e8360:$a51: Content-Length: %d
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.????????????.exe.25bf8a60000.2.raw.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x3a3ae:$xs1: WS2_32.dll 0x3a8a1:$xs2: ReflectiveLoader
3.2.????????????.exe.25bf8a60000.2.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x3a8a1:$x1: ReflectiveLoader
3.2.????????????.exe.25bf8a60000.2.raw.unpack	Cobaltbaltstrike_Beacon_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 0x3aa30:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E
3.2.????????????.exe.25bf8a60000.2.raw.unpack	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0xfe48:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
3.2.????????????.exe.25bf8a60000.2.raw.unpack	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x3aa30:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
3.2.????????????.exe.25bf8a60000.2.raw.unpack	CobaltStrike_MZ_Launcher	Detects CobaltStrike MZ header ReflectiveLoader launcher	yara@s3c.za.net	0x0:$mz_launcher: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D
3.2.????????????.exe.25bf8a60000.2.raw.unpack	HKTL_CobaltStrike_SleepMask_Jul22	Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated	CodeX	0x400:$sleep_mask: 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45
3.2.????????????.exe.25bf8a60000.2.raw.unpack	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3ad8e:$xo1: cATGBBO\x01\x1B\x1E
3.2.????????????.exe.25bf8a60000.2.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
3.2.????????????.exe.25bf8a60000.2.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b700:$a39: %s as %s\%s: %d 0x3a892:$a41: beacon.x64.dll 0x2c900:$a46: %s (admin) 0x2b860:$a48: %s%s: %s 0x2b72c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b758:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2c949:$a51: Content-Length: %d
3.2.????????????.exe.25bf8a60000.2.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x183d8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
3.2.????????????.exe.25bf8a60000.2.raw.unpack	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xfeb5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
3.2.????????????.exe.25bf8a60000.2.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1608a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1731b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
3.2.????????????.exe.c000294000.1.raw.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x3a3ae:$xs1: WS2_32.dll 0x3a8a1:$xs2: ReflectiveLoader
3.2.????????????.exe.c000294000.1.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x3a8a1:$x1: ReflectiveLoader
3.2.????????????.exe.c000294000.1.raw.unpack	Cobaltbaltstrike_Beacon_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 0x3aa30:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E
3.2.????????????.exe.c000294000.1.raw.unpack	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0xfe48:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
3.2.????????????.exe.c000294000.1.raw.unpack	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x3aa30:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
3.2.????????????.exe.c000294000.1.raw.unpack	CobaltStrike_MZ_Launcher	Detects CobaltStrike MZ header ReflectiveLoader launcher	yara@s3c.za.net	0x0:$mz_launcher: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D
3.2.????????????.exe.c000294000.1.raw.unpack	HKTL_CobaltStrike_SleepMask_Jul22	Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated	CodeX	0x400:$sleep_mask: 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45
3.2.????????????.exe.c000294000.1.raw.unpack	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3ad8e:$xo1: cATGBBO\x01\x1B\x1E
3.2.????????????.exe.c000294000.1.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
3.2.????????????.exe.c000294000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b700:$a39: %s as %s\%s: %d 0x3a892:$a41: beacon.x64.dll 0x2c900:$a46: %s (admin) 0x2b860:$a48: %s%s: %s 0x2b72c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b758:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2c949:$a51: Content-Length: %d
3.2.????????????.exe.c000294000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x183d8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
3.2.????????????.exe.c000294000.1.raw.unpack	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xfeb5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
3.2.????????????.exe.c000294000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1608a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1731b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
3.2.????????????.exe.c000294000.1.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x393ae:$xs1: WS2_32.dll 0x398a1:$xs2: ReflectiveLoader
3.2.????????????.exe.c000294000.1.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x398a1:$x1: ReflectiveLoader
3.2.????????????.exe.c000294000.1.unpack	Cobaltbaltstrike_Beacon_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 0x39a30:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E
3.2.????????????.exe.c000294000.1.unpack	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0xf248:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
3.2.????????????.exe.c000294000.1.unpack	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x39a30:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
3.2.????????????.exe.c000294000.1.unpack	CobaltStrike_MZ_Launcher	Detects CobaltStrike MZ header ReflectiveLoader launcher	yara@s3c.za.net	0x0:$mz_launcher: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D
3.2.????????????.exe.c000294000.1.unpack	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x39d8e:$xo1: cATGBBO\x01\x1B\x1E
3.2.????????????.exe.c000294000.1.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.c000294000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2ab00:$a39: %s as %s\%s: %d 0x39892:$a41: beacon.x64.dll 0x2b900:$a46: %s (admin) 0x2ac60:$a48: %s%s: %s 0x2ab2c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2ab58:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b949:$a51: Content-Length: %d
3.2.????????????.exe.c000294000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x177d8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
3.2.????????????.exe.c000294000.1.unpack	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xf2b5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
3.2.????????????.exe.c000294000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1548a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1671b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
3.2.????????????.exe.25bf8a60000.2.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x393ae:$xs1: WS2_32.dll 0x398a1:$xs2: ReflectiveLoader
3.2.????????????.exe.25bf8a60000.2.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x398a1:$x1: ReflectiveLoader
3.2.????????????.exe.25bf8a60000.2.unpack	Cobaltbaltstrike_Beacon_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 0x39a30:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E
3.2.????????????.exe.25bf8a60000.2.unpack	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0xf248:$sleep_decoder: 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9
3.2.????????????.exe.25bf8a60000.2.unpack	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x39a30:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2B 8D 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A 2E 3E 2E 2E 2E 2B 2E 2F 2E 2C 2E 2E
3.2.????????????.exe.25bf8a60000.2.unpack	CobaltStrike_MZ_Launcher	Detects CobaltStrike MZ header ReflectiveLoader launcher	yara@s3c.za.net	0x0:$mz_launcher: 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D
3.2.????????????.exe.25bf8a60000.2.unpack	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x39d8e:$xo1: cATGBBO\x01\x1B\x1E
3.2.????????????.exe.25bf8a60000.2.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
3.2.????????????.exe.25bf8a60000.2.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2ab00:$a39: %s as %s\%s: %d 0x39892:$a41: beacon.x64.dll 0x2b900:$a46: %s (admin) 0x2ac60:$a48: %s%s: %s 0x2ab2c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2ab58:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b949:$a51: Content-Length: %d
3.2.????????????.exe.25bf8a60000.2.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x177d8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
3.2.????????????.exe.25bf8a60000.2.unpack	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xf2b5:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
3.2.????????????.exe.25bf8a60000.2.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1548a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1671b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Click to see the 59 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1a#U77e5.exe	Virustotal: Detection: 61%	Perma Link
Source: 1a#U77e5.exe	Metadefender: Detection: 22%	Perma Link
Source: 1a#U77e5.exe	ReversingLabs: Detection: 76%

Antivirus / Scanner detection for submitted sample

Source: 1a#U77e5.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://124.221.206.154:1443/ubmit.phpn	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/ubmit.php	Avira URL Cloud: Label: malware
Source: https://124.221.206.154/n-US	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/	Avira URL Cloud: Label: malware
Source: https://124.221.206.154/W	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpo	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpw	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpy	Avira URL Cloud: Label: malware
Source: https://124.221.206.154/-	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpx	Avira URL Cloud: Label: malware
Source: 124.221.206.154	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/0;	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpI	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpQ	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpc	Avira URL Cloud: Label: malware
Source: https://124.221.206.154:1443/submit.phpe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\Temp\????????????.exe

Avira: detection malicious, Label: HEUR/AGEN.1211767

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\????????????.exe	Metadefender: Detection: 25%			Perma Link
Source: C:\Windows\Temp\????????????.exe	ReversingLabs: Detection: 61%

Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 1443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "124.221.206.154,/submit.php", "HttpPostUri": "/submit.jsp", "Malleable_C2_Instructions": [], "SpawnTo": "AAAAAAAAAAAAAAAAAAAAAA==", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 0, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Source: 1a#U77e5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\Temp\????????????.exe	Code function: 4x nop then sub rbx, qword ptr [rax+18h]
Source: C:\Windows\Temp\????????????.exe	Code function: 4x nop then mov r8, 0000800000000000h

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 124.221.206.154

Source: Joe Sandbox View

ASN Name: JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR

Source: global traffic

TCP traffic: 192.168.2.5:49755 -> 124.221.206.154:1443

Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154
Source: unknown	TCP traffic detected without corresponding DNS query: 124.221.206.154

Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154/
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154/-
Source: ????????????.exe, 00000003.00000002.707682885.0000025BF36AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154/W
Source: ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154/n-US
Source: ????????????.exe, 00000003.00000003.680436999.0000025BF36DA000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450674237.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645708761.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546244712.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472618349.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515410872.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707824461.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507054004.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565779330.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/
Source: ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/(
Source: ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/0;
Source: ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/9.0;
Source: ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/a
Source: ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/e
Source: ????????????.exe, 00000003.00000002.707682885.0000025BF36AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/l
Source: ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.php
Source: ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.php-
Source: ????????????.exe, 00000003.00000002.707682885.0000025BF36AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.php154:1443/N
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.php3
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.php?
Source: ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpG
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpI
Source: ????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpParameters
Source: ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpQ
Source: ????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpa19e716f260s
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpc
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpe
Source: ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpo
Source: ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpw
Source: ????????????.exe, 00000003.00000002.707682885.0000025BF36AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpx
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/submit.phpy
Source: ????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/ubmit.php
Source: ????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/ubmit.phpn
Source: ????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://124.221.206.154:1443/ubmit.phpra
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.aadrm.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.aadrm.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.cortana.ai
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.office.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.onedrive.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://augloop.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cdn.entity.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://clients.config.office.net/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://config.edge.skype.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cortana.ai
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cortana.ai/api
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://cr.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dev.cortana.ai
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://devnull.onenote.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://directory.services.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://graph.windows.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://graph.windows.net/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://invites.office.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://lifecycle.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://login.windows.local
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://management.azure.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://management.azure.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.action.office.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://messaging.office.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ncus.contentsync.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://officeapps.live.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://onedrive.live.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://osi.office.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office365.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office365.com/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://roaming.edog.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://settings.outlook.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://staging.cortana.ai
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://tasks.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://wus2.contentsync.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: FireEye
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: Process Memory Space: ????????????.exe PID: 3016, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Cobaltbaltstrike_Beacon_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_MZ_Launcher date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike MZ header ReflectiveLoader launcher
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_CobaltStrike_SleepMask_Jul22 date = 2022-07-04, author = CodeX, description = Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, score = , reference = https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Cobaltbaltstrike_Beacon_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_MZ_Launcher date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike MZ header ReflectiveLoader launcher
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_CobaltStrike_SleepMask_Jul22 date = 2022-07-04, author = CodeX, description = Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, score = , reference = https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Cobaltbaltstrike_Beacon_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_MZ_Launcher date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike MZ header ReflectiveLoader launcher
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Cobaltbaltstrike_Beacon_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_MZ_Launcher date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike MZ header ReflectiveLoader launcher
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000003.00000002.706923007.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_Beacon_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000003.00000002.705984762.000000C000174000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_Beacon_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date = 2020-12-02, author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_CobaltStrike_SleepMask_Jul22 date = 2022-07-04, author = CodeX, description = Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, score = , reference = https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000003.00000002.706488711.000000C00023E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_Beacon_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_Beacon_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_MZ_Launcher date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike MZ header ReflectiveLoader launcher
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_CobaltStrike_SleepMask_Jul22 date = 2022-07-04, author = CodeX, description = Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, score = , reference = https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_Beacon_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2021-07-19, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_MZ_Launcher date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike MZ header ReflectiveLoader launcher
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_CobaltStrike_SleepMask_Jul22 date = 2022-07-04, author = CodeX, description = Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, score = , reference = https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: Process Memory Space: ????????????.exe PID: 3016, type: MEMORYSTR	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, score = , reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Source: Process Memory Space: ????????????.exe PID: 3016, type: MEMORYSTR	Matched rule: Cobaltbaltstrike_Beacon_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: Process Memory Space: ????????????.exe PID: 3016, type: MEMORYSTR	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: Process Memory Space: ????????????.exe PID: 3016, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01318900
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_013121C0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0131C9C0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0130B8E0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0130ACE0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01334F00
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01324F60
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01345B60
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0131B3A0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01304780
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01304BE0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0131B7E0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01315BE0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0131C200
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0132E600
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01311665
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01308240
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01322240
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01303EA0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0130A2C0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_01324AC0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A88FE0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A747D0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A7A0B4
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A87060
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A86190
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A7B9E8
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A879D0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A6916C
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A80144
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A752C0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A7C2CC
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A8533C
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A6EC30
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A7CC10
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A86D77
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A69680
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A7AE74
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ACACB4
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ACD810
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8AC53D0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8AD7C60
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ACC5E8
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8AD85D0
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ACCD54

Source: C:\Windows\Temp\????????????.exe	Code function: String function: 01332C40 appears 247 times
Source: C:\Windows\Temp\????????????.exe	Code function: String function: 01330BA0 appears 191 times
Source: C:\Windows\Temp\????????????.exe	Code function: String function: 013323C0 appears 39 times

Source: C:\Windows\System32\cmd.exe

Section loaded: sfc.dll

Source: 1a#U77e5.exe	Static PE information: Number of sections : 14 > 10
Source: ????????????.exe.0.dr	Static PE information: Number of sections : 13 > 10

Source: 1a#U77e5.exe	Static PE information: Section: /19 ZLIB complexity 0.9987782579787234
Source: 1a#U77e5.exe	Static PE information: Section: /32 ZLIB complexity 0.9890455163043478
Source: 1a#U77e5.exe	Static PE information: Section: /65 ZLIB complexity 0.9983048349056604
Source: 1a#U77e5.exe	Static PE information: Section: /78 ZLIB complexity 0.9892698688271605
Source: ????????????.exe.0.dr	Static PE information: Section: /19 ZLIB complexity 0.9949880125661376
Source: ????????????.exe.0.dr	Static PE information: Section: /32 ZLIB complexity 0.9894425675675675
Source: ????????????.exe.0.dr	Static PE information: Section: /65 ZLIB complexity 0.9975082694986073
Source: ????????????.exe.0.dr	Static PE information: Section: /78 ZLIB complexity 0.9895907315340909

Source: 1a#U77e5.exe	Virustotal: Detection: 61%
Source: 1a#U77e5.exe	Metadefender: Detection: 22%
Source: 1a#U77e5.exe	ReversingLabs: Detection: 76%

Source: 1a#U77e5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1a#U77e5.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\1a#U77e5.exe "C:\Users\user\Desktop\1a#U77e5.exe"
Source: C:\Users\user\Desktop\1a#U77e5.exe	Process created: C:\Windows\Temp\????????????.exe C:\Windows\Temp\????????????.exe 9gb3vbgeng
Source: C:\Windows\Temp\????????????.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1a#U77e5.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ?????????????????????.docx
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\?????????????????????.docx" /o "
Source: C:\Users\user\Desktop\1a#U77e5.exe	Process created: C:\Windows\Temp\????????????.exe C:\Windows\Temp\????????????.exe 9gb3vbgeng
Source: C:\Users\user\Desktop\1a#U77e5.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ?????????????????????.docx
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\?????????????????????.docx" /o "

Source: C:\Windows\Temp\????????????.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: ?????????????????????.LNK.7.dr

LNK file: ..\..\..\..\..\Desktop\.docx

Source: C:\Users\user\Desktop\1a#U77e5.exe

File created: C:\Users\user\Desktop\?????????????????????.docx

Jump to behavior

Source: C:\Users\user\Desktop\1a#U77e5.exe

File created: C:\Windows\Temp\????????????.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/8@0/1

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2164:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_01

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source: 1a#U77e5.exe

Static file information: File size 4732928 > 1048576

Source: 1a#U77e5.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x33da00

Source: 1a#U77e5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8A920EC push 0000006Ah; retf
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ABA71E push cs; retf
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8AD60DB push ebp; iretd
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8AD6124 push ebp; iretd
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8AD60FB push ebp; iretd
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ABA35D push edi; iretd
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ABBD58 push ebp; iretd
Source: C:\Windows\Temp\????????????.exe	Code function: 3_2_0000025BF8ADAE68 push ebp; iretd

Source: 1a#U77e5.exe	Static PE information: section name: /4
Source: 1a#U77e5.exe	Static PE information: section name: /19
Source: 1a#U77e5.exe	Static PE information: section name: /32
Source: 1a#U77e5.exe	Static PE information: section name: /46
Source: 1a#U77e5.exe	Static PE information: section name: /65
Source: 1a#U77e5.exe	Static PE information: section name: /78
Source: 1a#U77e5.exe	Static PE information: section name: /90
Source: 1a#U77e5.exe	Static PE information: section name: .symtab
Source: ????????????.exe.0.dr	Static PE information: section name: /4
Source: ????????????.exe.0.dr	Static PE information: section name: /19
Source: ????????????.exe.0.dr	Static PE information: section name: /32
Source: ????????????.exe.0.dr	Static PE information: section name: /46
Source: ????????????.exe.0.dr	Static PE information: section name: /65
Source: ????????????.exe.0.dr	Static PE information: section name: /78
Source: ????????????.exe.0.dr	Static PE information: section name: /90
Source: ????????????.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\1a#U77e5.exe

File created: C:\Windows\Temp\????????????.exe

Jump to dropped file

Source: C:\Users\user\Desktop\1a#U77e5.exe

File created: C:\Windows\Temp\????????????.exe

Jump to dropped file

Source: C:\Users\user\Desktop\1a#U77e5.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\1a#U77e5.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\????????????.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Temp\????????????.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Source: C:\Windows\Temp\????????????.exe TID: 2264

Thread sleep time: -1800000s >= -30000s

Source: C:\Windows\Temp\????????????.exe	Last function: Thread delayed
Source: C:\Windows\Temp\????????????.exe	Last function: Thread delayed

Source: C:\Windows\Temp\????????????.exe

Code function: 3_2_013582C0 rdtscp

Source: C:\Windows\Temp\????????????.exe

Thread delayed: delay time: 60000

Source: 1a#U77e5.exe, 00000000.00000002.441267582.0000027D4128C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllMM]
Source: ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Windows\Temp\????????????.exe

Code function: 3_2_013582C0 Start: 013582C9 End: 013582DF

Source: C:\Windows\Temp\????????????.exe

Code function: 3_2_013582C0 rdtscp

Source: C:\Users\user\Desktop\1a#U77e5.exe	Process created: C:\Windows\Temp\????????????.exe C:\Windows\Temp\????????????.exe 9gb3vbgeng
Source: C:\Users\user\Desktop\1a#U77e5.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ?????????????????????.docx
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\?????????????????????.docx" /o "

Source: C:\Windows\Temp\????????????.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\Temp\????????????.exe

Code function: 3_2_0000025BF8AC3B5C GetUserNameA,strrchr,_snprintf,

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 3.2.????????????.exe.25bf8a60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.????????????.exe.c000294000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.????????????.exe.c000294000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.????????????.exe.25bf8a60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ????????????.exe PID: 3016, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Software Packing	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1a#U77e5.exe	61%	Virustotal		Browse
1a#U77e5.exe	23%	Metadefender		Browse
1a#U77e5.exe	77%	ReversingLabs	Win64.Trojan.CobaltStrike
1a#U77e5.exe	100%	Avira	TR/CobaltStrike.fyzok

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Temp\????????????.exe	100%	Avira	HEUR/AGEN.1211767
C:\Windows\Temp\????????????.exe	26%	Metadefender		Browse
C:\Windows\Temp\????????????.exe	62%	ReversingLabs	Win64.Downloader.Gobalt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.????????????.exe.1300000.0.unpack	100%	Avira	HEUR/AGEN.1211767	Download File
0.0.1a#U77e5.exe.2a0000.0.unpack	100%	Avira	HEUR/AGEN.1211854	Download File
0.2.1a#U77e5.exe.2a0000.0.unpack	100%	Avira	HEUR/AGEN.1211854	Download File
3.0.????????????.exe.1300000.0.unpack	100%	Avira	HEUR/AGEN.1211767	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://124.221.206.154:1443/ubmit.phpn	100%	Avira URL Cloud	malware
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://124.221.206.154:1443/ubmit.php	100%	Avira URL Cloud	malware
https://124.221.206.154/n-US	100%	Avira URL Cloud	malware
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://124.221.206.154:1443/	100%	Avira URL Cloud	malware
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://124.221.206.154/W	100%	Avira URL Cloud	malware
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://124.221.206.154:1443/submit.phpo	100%	Avira URL Cloud	malware
https://ncus.contentsync.	0%	URL Reputation	safe
https://124.221.206.154:1443/submit.phpw	100%	Avira URL Cloud	malware
https://124.221.206.154:1443/submit.phpy	100%	Avira URL Cloud	malware
https://124.221.206.154/-	100%	Avira URL Cloud	malware
https://124.221.206.154:1443/submit.phpx	100%	Avira URL Cloud	malware
https://apis.live.net/v5.0/	0%	URL Reputation	safe
124.221.206.154	100%	Avira URL Cloud	malware
https://124.221.206.154:1443/0;	100%	Avira URL Cloud	malware
https://124.221.206.154:1443/submit.phpI	100%	Avira URL Cloud	malware
https://wus2.contentsync.	0%	URL Reputation	safe
https://124.221.206.154:1443/submit.phpQ	100%	Avira URL Cloud	malware
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://124.221.206.154:1443/submit.phpc	100%	Avira URL Cloud	malware
https://124.221.206.154:1443/submit.phpe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
124.221.206.154	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://login.microsoftonline.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://shell.suite.office.com:1443	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://autodiscover-s.outlook.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://roaming.edog.	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://cdn.entity.	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://powerlift.acompli.net	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://cortana.ai	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://entitlement.diagnosticssdf.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://api.aadrm.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/ubmit.phpn	????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.microsoftstream.com/api/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://cr.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://graph.ppe.windows.net	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://officeci.azurewebsites.net/api/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/ubmit.php	????????????.exe, 00000003.00000002.707570619.0000025BF3699000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://124.221.206.154/n-US	????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://my.microsoftpersonalcontent.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://124.221.206.154:1443/	????????????.exe, 00000003.00000003.680436999.0000025BF36DA000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450674237.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645708761.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546244712.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472618349.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515410872.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707824461.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507054004.0000025BF36D1000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565779330.0000025BF36CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.aadrm.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://globaldisco.crm.dynamics.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://messaging.engagement.office.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://dev0-api.acompli.net/autodetect	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://web.microsoftstream.com/video/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://dataservice.o365filtering.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://124.221.206.154/W	????????????.exe, 00000003.00000002.707682885.0000025BF36AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://officesetup.getmicrosoftkey.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/submit.phpo	????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://ncus.contentsync.	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://124.221.206.154:1443/submit.phpw	????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/submit.phpy	????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://124.221.206.154/-	????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://124.221.206.154:1443/submit.phpx	????????????.exe, 00000003.00000002.707682885.0000025BF36AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
http://weather.service.msn.com/data.aspx	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://apis.live.net/v5.0/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/0;	????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://messaging.lifecycle.office.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/submit.phpI	????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://management.azure.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://outlook.office365.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://wus2.contentsync.	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://clients.config.office.net/user/v1.0/ios	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/submit.phpQ	????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.463998398.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.507141900.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://insertmedia.bing.office.net/odc/insertmedia	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://api.office.net	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://incidents.diagnosticssdf.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://entitlement.diagnostics.office.com	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://substrate.office.com/search/api/v2/init	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/submit.phpc	????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.698330034.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.519760880.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.515437734.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.533004895.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.595821118.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://outlook.office.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://124.221.206.154:1443/submit.phpe	????????????.exe, 00000003.00000003.528285189.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.511119713.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.550870441.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.546326792.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.650269287.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.446429982.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000002.707886816.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.459728313.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.455168561.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.581376031.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.555953821.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.561061987.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.630445997.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.565837469.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.645791258.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.468267152.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.472644248.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.625692730.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.680612251.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.450683931.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp, ????????????.exe, 00000003.00000003.524018797.0000025BF36E3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://storage.live.com/clientlogs/uploadlocation	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high
https://outlook.office365.com/	E231148E-230F-4D9C-B6F4-7F66C34B8E20.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
124.221.206.154	unknown	China		45361	JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679126
Start date and time: 05/08/202209:54:36	2022-08-05 09:54:36 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 33s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	1a#U77e5.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/8@0/1
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 45.8% (good quality ratio 43%) Quality average: 68.2% Quality standard deviation: 27.6%
HCA Information:	Successful, ratio: 81% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 52.109.88.191, 52.109.76.33, 52.109.12.21, 20.238.103.94, 20.223.24.244
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, prod-w.nexus.live.com.akadns.net, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, licensing.mp.microsoft.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, store-images.s-microsoft.com, login.live.com, config.officeapps.live.com, sls.update.microsoft.com, nexus.officeapps.live.com, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Execution Graph export aborted for target 1a#U77e5.exe, PID 5296 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:55:50	API Interceptor	30x Sleep call for process: ????????????.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E231148E-230F-4D9C-B6F4-7F66C34B8E20

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	148061
Entropy (8bit):	5.35816450806037
Encrypted:	false
SSDEEP:	1536:ncQW/gxgB5BQguwN/Q9DQe+zQTk4F77nXmvid3XxVETLKz61:W1Q9DQe+zuXYr
MD5:	DD89B24BAA865B152396CB932251EA2F
SHA1:	D0DB98C4FE2E281C64DF4F44DF5279F34E56DB54
SHA-256:	E25E7342FAD7C59D3D7E5F224BC370F1541CE3AD01FAF4C922F84F71137AF827
SHA-512:	E6599769C65FE10E4E70997B37F2A343BB6169C3FD09DB837A51386BE4E5DA019AF389D1AF09DABF60A80FD45F2347F6244930AA4AEBBE31066772D048039880
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-08-05T07:55:52">.. Build: 16.0.15601.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\?????????????????????.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 5 15:55:47 2022, mtime=Fri Aug 5 15:55:52 2022, atime=Fri Aug 5 15:55:47 2022, length=16768, window=hide
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.014235188340708
Encrypted:	false
SSDEEP:	12:81t6bU9G6CHihArh3GXqDkDlM8+WABe1OW7EO/ypaZFVW7LVW7KNDyffD4t2Y+x4:81ZArsUkDuPW7EOKqW7hW7ODyR7aB6m
MD5:	355E58BF021D90BF3CCDCD8503F910A1
SHA1:	34D3B542D1ABDD5B042B1BF790EEBD705899BFAC
SHA-256:	F40C4F240348D97AB8EB36F2DAA14F896B297339E8E2581A84AEC5AB20AB7AFD
SHA-512:	5A17937914179F6E98746DC8D45C82632DA16361A5E126E9403C74AC741E3D69FBF081B14FF1DDB7FDC4948C957ED0FDEBCB9C9B069D84069A21C6A4FB488A1F
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...g.5...}-.8.../S.5....A...........................P.O. .:i.....+00.../C:\...................x.1......Ng...Users.d......L...U......................:......B..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....T.1.....hT....user..>.......NM..U.......S.....................`..a.l.f.o.n.s.....~.1......U....Desktop.h.......NM..U.......Y..............>......"Y.D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..A...U.. .6ADF~1.DOC..f.......U...U.............................V.sQ.N..V.SP[lQ.S._U\Q..~.[hQ;e2..o`N.v...w..d.o.c.x...........$.......$...5...........h...............>.S......C:\Users\user\Desktop\?????????????????????.docx.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.D.e.s.k.t.o.p.\.sQ.N..V.SP[lQ.S._U\Q..~.[hQ;e2..o`N.v...w..d.o.c.x.......1.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.sQ.N..V.SP[lQ.S._U\Q..~.[hQ;e2..o`N.v...w..d.o.c.x.........:..,.LB.)...Aw...`.......X.......927537...........!a..%.H.VZAj.....s.........W...!a..%.H.VZAj..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	3.408464248242645
Encrypted:	false
SSDEEP:	3:bDuMJlWt6lmxWLRt6lv:bCNkRS
MD5:	113750065807DAD15C00A178EB21FC45
SHA1:	903505EE9B97E1FA7F39E9B9ECE4DE9B286E9289
SHA-256:	04AFC953D6AAE679A3ABDBE0FF0B8C144B16D4CCF84959A2793E57F6777AB8DF
SHA-512:	1F89B0584EEB6381314116748832AF82310053B659721AD6A07041FEAAA8E03E1A0EAF4C5400E1BBBB415B4A678C2C20F788AB8A69A6E2BB06436FB8B7C2DF8B
Malicious:	false
Reputation:	low
Preview:	[folders]..Templates.LNK=0..?????????????????????.LNK=0..[misc]..?????????????????????.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.9237687128468073
Encrypted:	false
SSDEEP:	3:Rl/Zdn98Udk1+lllllzHLl+l/Lcalt13l/9l:RtZT8Uq0ll/Ml/V
MD5:	8DCBD88C0E65C7ECD29DAE006EE77D62
SHA1:	EC6B2ADD4B3D90DB15700AC4D17BD605A33C870F
SHA-256:	B1895309312CB6286E97EE77C39BDF25D76C3298190EADB8DB26D487D2E3C7DF
SHA-512:	876FAF0B0681079CFA978F84C0BA46318998807C29811E4874D166F66D1E6E241E2237AEB26498E823193885E05BCDA230C357A91B640C35204D031333ECDC2A
Malicious:	false
Reputation:	low
Preview:	.pratesh................................................p.r.a.t.e.s.h.....L+....9i.0..............f.........q...5i.1.../........................1i.2..............

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Little-endian UTF-16 Unicode text, with CR line terminators
Category:	modified
Size (bytes):	20
Entropy (8bit):	2.8954618442383215
Encrypted:	false
SSDEEP:	3:QVNliGn:Q9rn
MD5:	C4F79900719F08A6F11287E3C7991493
SHA1:	754325A769BE6ECCC664002CD8F6BDB0D0B8CA4D
SHA-256:	625CA96CCA65A363CC76429804FF47520B103D2044BA559B11EB02AB7B4D79A8
SHA-512:	0F3C498BC7680B4C9167F790CC0BE6C889354AF703ABF0547F87B78FEB0BAA9F5220691DF511192B36AD9F3F69E547E6D382833E6BC25CDB4CD2191920970C5F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..p.r.a.t.e.s.h.....

C:\Users\user\Desktop\?????????????????????.docx

Download File

Process:	C:\Users\user\Desktop\1a#U77e5.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	7.828953909266841
Encrypted:	false
SSDEEP:	384:aYn7elOjZppldfDmfFPpT83uzRz/4id7miP9jT:aYnKlOjZPldfDMFPG+zRz5p
MD5:	5F48BBB1AAC3B8D63AAAE3EC114BA340
SHA1:	31FC3508AF156D67DA4BC6FE8D41206BDA5276EE
SHA-256:	80596668ABC2C8C42481AD06713039198F08EB11C543061C3F9657A51248D04F
SHA-512:	F5C3AF4E2269094C5381C512AE2A13C8204A34477DD47DB5D7ED4FC7BC986ECB36B2EF17B0A7470D1CB64404B8035CB7D27563C45E7F8E94FA92CFB9E3F6B9E8
Malicious:	false
Preview:	PK.........N.@................docProps/PK.........N.@...j...\|.......docProps/app.xml.R.N.0..#..Q...-....'...@..r..Eb[.A..q^Q.Wn;3.x.c.......WF.R..4A-M..a.>7.."M\|.....J....~y..g,...'.B.U.`....A.<.:{..."t.b.{%.....u .......6.g...x...j..9../.......l/...c.>oM...Y..z>.r.`g\.y.,..F.;..qS.UU.dB....8..9M......<......o.\|A.}?..R.X..\|/z.@~..7.l.s7>.[.MN..T.V.1.,.Y'.....!V.w.m....W....r.fW......W.uVT.:...6[...hY.s.....@.N...\|w.9.2.q....PK.........N.@N..e............docProps/core.xml}..N.1...H.......$..Y$Z.T.J..........)\.K...@j..K.y..q.+..I.A .3..7.x...4..u3]D...`D&..t.a..vP.<7.......C{..V,r&2..l....\P..c"..9..!h........j...p...>......<..s\..&..R.....i...C...w.6(...`.{...l(...iew.-.X.O.....1nV6.......X..S.....RT..=....u.S..~.%..hH....I..e.\|..Z../.KVf...2....H........Ir.....t1...].~}.]....._.?\|.........ySm[.@...B..I.O[l.....k@RZ.0R..K..N5.NT...<.PK.........N.@....'...........docProps/custom.xml...K.0....C.=....mG. .....4..MR.t:.............}.{..E..(..

C:\Users\user\Desktop\~$???????????????????.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.9237687128468073
Encrypted:	false
SSDEEP:	3:Rl/Zdn98Udk1+lllllzHLl+l/Lcalt13l/9l:RtZT8Uq0ll/Ml/V
MD5:	8DCBD88C0E65C7ECD29DAE006EE77D62
SHA1:	EC6B2ADD4B3D90DB15700AC4D17BD605A33C870F
SHA-256:	B1895309312CB6286E97EE77C39BDF25D76C3298190EADB8DB26D487D2E3C7DF
SHA-512:	876FAF0B0681079CFA978F84C0BA46318998807C29811E4874D166F66D1E6E241E2237AEB26498E823193885E05BCDA230C357A91B640C35204D031333ECDC2A
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h.....L+....9i.0..............f.........q...5i.1.../........................1i.2..............

C:\Windows\Temp\????????????.exe

Download File

Process:	C:\Users\user\Desktop\1a#U77e5.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2062848
Entropy (8bit):	6.989271790744726
Encrypted:	false
SSDEEP:	24576:VLG1BKsKoBqgde0DTIK2u4WXr3R0lgaWPPCwha1w0UHfLBamlNRDz:VLGKTZBermgaWPPCwha14/LR
MD5:	84E3D79DA5E503374E61A17351781C14
SHA1:	6C4710E5E6BC0F991C6954E64E76EC8BF796A2E1
SHA-256:	6254E9F7F9E61A1A80E8A3C01757B8D29C9AC0EB0D596236FC0A2944FD44DFD6
SHA-512:	B287D405B01AAA7B7C35AE1787395CCE626A4565B28BB74D2AA715D251D580AAB4EEE513D29885728B56F0175CB13238B6DCF0EC228DB83C6AC90CA7EEECC4D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..........9....."..........Z......`.........@...............................%...........`... ...............................................#.\|.............................$..%.................................................. Q..@............................text............................... ..`.rdata...#... ...$..................@..@.data........P...Z...:..............@.../4......'....P......................@..B/19.....=x...`...z..................@..B/32.....,I.......J..................@..B/46.........0.......Z..............@..B/65.....-....@.......\..............@..B/78.....I_...."..`.................@..B/90.....\|r...p#..t..................@..B.idata..\|.....#.....................@....reloc...%....$..&..................@..B.symtab..O...0$..P....................B........................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.725931255932212
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	1a#U77e5.exe
File size:	4732928
MD5:	3f2202e24ad0a66c08f88a18dd7b5fb4
SHA1:	62df51eb1351279afa4dbe5920758d6974427ac9
SHA256:	eb94cd39cde6a5270181d6e6788c69a2a90ab2b27f9236c8382e810e4dfead1d
SHA512:	cd87c99ce09a29a5317343e04bb55fd63cd0b98cebcb08793a9b1dd275a9c6ce09c53fb7f901fc6083d8992360d3fbe02438d4143a907be64e7bdca15567bc27
SSDEEP:	49152:BuZC3FJrb/TWvO90dL3BmAFd4A64nsfJ+WNq3v3MVkOHx3bEnnkY3Xw4g9MUth7A:aC3F0uKUrwUZ0
TLSH:	2426BF333982B8FADAAD697184242D411D7CB88B172053C7BB4975FE36BA2D44D3C768
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........F.P....."..........~......@.........@..............................PN...........`... ............................

File Icon


Icon Hash:	554d5c5469694525

Static PE Info

General

Entrypoint:	0x45ca40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007FAA8CC452C0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
dec eax
sub esp, 30h
dec ecx
mov edi, eax
dec eax
mov edx, dword ptr [00000028h]
dec eax
cmp edx, 00000000h
jne 00007FAA8CC48F4Eh
dec eax
mov eax, 00000000h
jmp 00007FAA8CC48FC5h
dec eax
mov edx, dword ptr [edx+00000000h]
dec eax
cmp edx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4c6000	0x47c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e2000	0x2678	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c7000	0x2b0a	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3cf140	0x140	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8fc6a	0x8fe00	False	0.4675638710903562	data	6.177951506515494	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x91000	0x33d8f0	0x33da00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3cf000	0x720a0	0x17e00	False	0.35497791230366493	data	4.298912004398371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x442000	0x127	0x200	False	0.6171875	data	5.097874074212899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x443000	0x1d578	0x1d600	False	0.9987782579787234	data	7.993303104291631	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/32	0x461000	0x5b0b	0x5c00	False	0.9890455163043478	data	7.917262410977086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/46	0x467000	0x2a	0x200	False	0.091796875	data	0.7534025800416837	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/65	0x468000	0x34e35	0x35000	False	0.9983048349056604	data	7.995735953621072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/78	0x49d000	0x1e401	0x1e600	False	0.9892698688271605	data	7.987159878797264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/90	0x4bc000	0x977c	0x9800	False	0.9757401315789473	data	7.788382558202588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x4c6000	0x47c	0x600	False	0.3313802083333333	data	3.514698326038637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x4c7000	0x2b0a	0x2c00	False	0.3710049715909091	data	5.397043934669771	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x4ca000	0x17c10	0x17e00	False	0.2733045647905759	data	5.119810305846417	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x4e2000	0x2678	0x2800	False	0.43115234375	data	5.682287008823302	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x4e20b8	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4280181209, next used block 4280181211	English	United States
RT_GROUP_ICON	0x4e4660	0x14	data	English	United States

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 09:55:49.280426979 CEST	49755	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:49.470936060 CEST	1443	49755	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:50.056755066 CEST	49755	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:50.248254061 CEST	1443	49755	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:50.846036911 CEST	49755	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:51.035944939 CEST	1443	49755	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:51.151525021 CEST	49763	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:51.379904985 CEST	1443	49763	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:52.049324036 CEST	49763	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:52.277442932 CEST	1443	49763	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:52.846239090 CEST	49763	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:53.069526911 CEST	1443	49763	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:53.273742914 CEST	49767	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:53.499203920 CEST	1443	49767	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:54.049468994 CEST	49767	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:54.277996063 CEST	1443	49767	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:54.846920013 CEST	49767	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:55.072638988 CEST	1443	49767	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:55.255032063 CEST	49769	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:55.474117041 CEST	1443	49769	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:56.049721003 CEST	49769	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:56.268788099 CEST	1443	49769	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:56.846615076 CEST	49769	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:57.066648006 CEST	1443	49769	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:57.245265007 CEST	49776	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:57.465364933 CEST	1443	49776	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:58.065488100 CEST	49776	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:58.281260014 CEST	1443	49776	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:58.846745014 CEST	49776	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:59.065027952 CEST	1443	49776	124.221.206.154	192.168.2.5
Aug 5, 2022 09:55:59.198276997 CEST	49777	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:55:59.424679041 CEST	1443	49777	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:00.065619946 CEST	49777	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:00.291865110 CEST	1443	49777	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:00.862615108 CEST	49777	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:01.089356899 CEST	1443	49777	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:01.561662912 CEST	49778	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:01.754937887 CEST	1443	49778	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:02.363183022 CEST	49778	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:02.557374001 CEST	1443	49778	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:03.065870047 CEST	49778	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:03.259234905 CEST	1443	49778	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:03.430304050 CEST	49779	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:03.645586967 CEST	1443	49779	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:04.238054037 CEST	49779	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:04.453716993 CEST	1443	49779	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:05.050407887 CEST	49779	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:05.266046047 CEST	1443	49779	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:05.413183928 CEST	49780	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:05.616344929 CEST	1443	49780	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:06.238074064 CEST	49780	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:06.441137075 CEST	1443	49780	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:07.050636053 CEST	49780	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:07.253810883 CEST	1443	49780	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:07.442192078 CEST	49781	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:07.682126999 CEST	1443	49781	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:08.253863096 CEST	49781	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:08.493702888 CEST	1443	49781	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:09.066442966 CEST	49781	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:09.306078911 CEST	1443	49781	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:09.483295918 CEST	49782	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:12.566765070 CEST	49782	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:12.794334888 CEST	1443	49782	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:13.363702059 CEST	49782	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:25.599271059 CEST	49793	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:25.793513060 CEST	1443	49793	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:26.364763021 CEST	49793	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:26.559653997 CEST	1443	49793	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:27.067987919 CEST	49793	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:27.262059927 CEST	1443	49793	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:27.453006983 CEST	49805	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:27.669214964 CEST	1443	49805	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:28.239979029 CEST	49805	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:28.455928087 CEST	1443	49805	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:29.052509069 CEST	49805	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:29.268527985 CEST	1443	49805	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:29.495060921 CEST	49810	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:29.720386982 CEST	1443	49810	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:30.255779982 CEST	49810	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:30.481199026 CEST	1443	49810	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:31.068296909 CEST	49810	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:31.292104006 CEST	1443	49810	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:31.450253010 CEST	49816	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:31.668453932 CEST	1443	49816	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:32.255995035 CEST	49816	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:32.475545883 CEST	1443	49816	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:33.068542957 CEST	49816	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:33.286715031 CEST	1443	49816	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:33.424062014 CEST	49821	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:33.625540972 CEST	1443	49821	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:34.240472078 CEST	49821	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:34.441996098 CEST	1443	49821	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:35.053042889 CEST	49821	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:35.255081892 CEST	1443	49821	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:35.415158987 CEST	49829	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:35.633347034 CEST	1443	49829	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:36.240658045 CEST	49829	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:36.458710909 CEST	1443	49829	124.221.206.154	192.168.2.5
Aug 5, 2022 09:56:37.053587914 CEST	49829	1443	192.168.2.5	124.221.206.154
Aug 5, 2022 09:56:37.271845102 CEST	1443	49829	124.221.206.154	192.168.2.5

Target ID:	0
Start time:	09:55:44
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\1a#U77e5.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1a#U77e5.exe"
Imagebase:	0x2a0000
File size:	4732928 bytes
MD5 hash:	3F2202E24AD0A66C08F88A18DD7B5FB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: ????????????.exePID: 3016, Parent PID: 5296

General

Target ID:	3
Start time:	09:55:46
Start date:	05/08/2022
Path:	C:\Windows\Temp\????????????.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\????????????.exe 9gb3vbgeng
Imagebase:	0x1300000
File size:	2062848 bytes
MD5 hash:	84E3D79DA5E503374E61A17351781C14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Cobaltbaltstrike_Beacon_Encoded, Description: Detects CobaltStrike payloads, Source: 00000003.00000002.706923007.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: Cobaltbaltstrike_Beacon_Encoded, Description: Detects CobaltStrike payloads, Source: 00000003.00000002.705984762.000000C000174000.00000004.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: netbiosX, Florian Roth Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: FireEye Rule: CobaltStrike_Sleep_Decoder_Indicator, Description: Detects CobaltStrike sleep_mask decoder, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: HKTL_CobaltStrike_SleepMask_Jul22, Description: Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: CodeX Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000003.00000002.708528999.0000025BF8AB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Cobaltbaltstrike_Beacon_Encoded, Description: Detects CobaltStrike payloads, Source: 00000003.00000002.706488711.000000C00023E000.00000004.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: netbiosX, Florian Roth Rule: ReflectiveLoader, Description: Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Cobaltbaltstrike_Beacon_x64, Description: Detects CobaltStrike payloads, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: CobaltStrike_Sleep_Decoder_Indicator, Description: Detects CobaltStrike sleep_mask decoder, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator, Description: Detects CobaltStrike C2 encoded profile configuration, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_MZ_Launcher, Description: Detects CobaltStrike MZ header ReflectiveLoader launcher, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: HKTL_CobaltStrike_SleepMask_Jul22, Description: Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: CodeX Rule: SUSP_XORed_Mozilla, Description: Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000003.00000002.706659139.000000C000294000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: netbiosX, Florian Roth Rule: ReflectiveLoader, Description: Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Cobaltbaltstrike_Beacon_x64, Description: Detects CobaltStrike payloads, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: CobaltStrike_Sleep_Decoder_Indicator, Description: Detects CobaltStrike sleep_mask decoder, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator, Description: Detects CobaltStrike C2 encoded profile configuration, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_MZ_Launcher, Description: Detects CobaltStrike MZ header ReflectiveLoader launcher, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: HKTL_CobaltStrike_SleepMask_Jul22, Description: Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: CodeX Rule: SUSP_XORed_Mozilla, Description: Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000003.00000002.708356136.0000025BF8A60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 26%, Metadefender, Browse Detection: 62%, ReversingLabs
Reputation:	low

Analysis Process: conhost.exePID: 5860, Parent PID: 3016

General

Target ID:	4
Start time:	09:55:47
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 5788, Parent PID: 5296

General

Target ID:	5
Start time:	09:55:47
Start date:	05/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start ?????????????????????.docx
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 2164, Parent PID: 5788

General

Target ID:	6
Start time:	09:55:48
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WINWORD.EXEPID: 5308, Parent PID: 5788

General

Target ID:	7
Start time:	09:55:49
Start date:	05/08/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\?????????????????????.docx" /o "
Imagebase:	0xb60000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1a#U77e5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E231148E-230F-4D9C-B6F4-7F66C34B8E20

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\?????????????????????.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\Desktop\?????????????????????.docx

C:\Users\user\Desktop\~$???????????????????.docx

C:\Windows\Temp\????????????.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
1a#U77e5.exe