File name:

5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607

Full analysis: https://app.any.run/tasks/84501a5e-fa95-4f84-99e2-c658583c012e
Verdict: Malicious activity
Threats:

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 15:28:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
cobaltstrike
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections
MD5:

5B21EA0B6384FE9660B6C41C0684E65B

SHA1:

F6D0A1B6342187E0CC1490B89741ACB792AD45B4

SHA256:

5E1945F75E150219770E0E9537FC7674EBEB80A1C207982488C8D1D9E9334607

SSDEEP:

6144:3Mtk2rOo2GPRvnF+UK51WTViWtzXbpW4HWRrLCgsqtDbDriA0:3MtsGZw8vpW4HWLlbH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • COBALTSTRIKE has been detected (YARA)

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

    • Checks Windows Trust Settings

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

    • Connects to unusual port

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

  • INFO

    • Reads the computer name

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

    • Checks supported languages

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

    • Checks proxy server information

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

    • Reads the software policy settings

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)

    • Reads the machine GUID from the registry

      • 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(3836) 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe
C2 (1)101.37.34.164/match
BeaconTypeHTTPS
Port47535
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVMpbqf1F6IRCQyDS5nfGjwMrx enarJQcqGOd5p618ijUYNVH3JRuvzDgJgbDBu3+kG+/HadqJ0q3WwraSPrFMtYKF 8u2f247TKBEDJIzLehw8aHGptH+fixGSECIcvmz08jcjZaS1+PX3lctfltXFFDs3 uGOJH8lbTUap70aURwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTo00000000000000000000000000000000
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark666666666
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stub40ed048138df0b3e23a0ef24dc5efa1a
ProcInject_AllocationMethodVirtualAllocEx
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.3)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.34
CodeSize: 7168
InitializedDataSize: 323072
UninitializedDataSize: 1536
EntryPoint: 0x14a0
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #COBALTSTRIKE 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe

Process information

PID
CMD
Path
Indicators
Parent process
3836"C:\Users\admin\Desktop\5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe" C:\Users\admin\Desktop\5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
CobalStrike
(PID) Process(3836) 5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe
C2 (1)101.37.34.164/match
BeaconTypeHTTPS
Port47535
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVMpbqf1F6IRCQyDS5nfGjwMrx enarJQcqGOd5p618ijUYNVH3JRuvzDgJgbDBu3+kG+/HadqJ0q3WwraSPrFMtYKF 8u2f247TKBEDJIzLehw8aHGptH+fixGSECIcvmz08jcjZaS1+PX3lctfltXFFDs3 uGOJH8lbTUap70aURwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTo00000000000000000000000000000000
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark666666666
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stub40ed048138df0b3e23a0ef24dc5efa1a
ProcInject_AllocationMethodVirtualAllocEx
Total events
3 305
Read events
3 305
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
25
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4652
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4652
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4652
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3836
5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607.exe
101.37.34.164:47535
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
4652
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4652
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.154
  • 104.126.37.178
  • 104.126.37.186
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.123
  • 104.126.37.176
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 51.116.253.170
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5e1945f75e150219770e0e9537fc7674ebeb80a1c207982488c8d1d9e9334607