File name:

c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825

Full analysis: https://app.any.run/tasks/265554be-9d4a-4e99-add2-8f9d96e1f035
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: August 28, 2024, 06:44:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
cobaltstrike
backdoor
adware
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

3F167A4CB8B366843FC3547F7F564FA4

SHA1:

20A3B47C2415856FD9FF8D8A61B376C85F6C6B52

SHA256:

C3C1338EAA4025E765E84B85E277ED5A319A7D732FF2054B67ABA83578386825

SSDEEP:

12288:+cP5lUdwNtuHXqcn2388BZ9S1Equp2+YF4pMlJ:+cP5lUdwNtuHXqcj8BOyqup2+YapMlJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • COBALTSTRIKE has been detected (SURICATA)

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • COBALTSTRIKE has been detected (YARA)

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • Reads security settings of Internet Explorer

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • Access to an unwanted program domain was detected

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • Connects to unusual port

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
  • INFO

    • Reads the machine GUID from the registry

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • Checks proxy server information

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • Checks supported languages

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
    • Reads the computer name

      • c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe (PID: 1164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(1164) c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
C2 (1)47.99.72.48/cm
BeaconTypeHTTP
Port9898
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWTRSy+lcQ/aN2IvR3URsb3j28 DXhUNy3NkEPdNrMTpnQs1R3NeGNZ7ySVVzSznV6WWZa/2c214GpyfVEk317h+BNy 9RKeCmw7V/mSkRXVWqEEdC9kOHL11HuJRpGpORSxWHlozRYYHe+bUiVGv85zmCGo O4gv//4r69zUVyO9vwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTod7a9ca15a07f82bfd3b63020da38aa16
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark391144938
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stubb50b86d735412685eb6044ad8d01781c
ProcInject_AllocationMethodVirtualAllocEx
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.2)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.34
CodeSize: 8704
InitializedDataSize: 294912
UninitializedDataSize: 2560
EntryPoint: 0x14c0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #COBALTSTRIKE c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Users\admin\AppData\Local\Temp\c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe" C:\Users\admin\AppData\Local\Temp\c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
CobalStrike
(PID) Process(1164) c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
C2 (1)47.99.72.48/cm
BeaconTypeHTTP
Port9898
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWTRSy+lcQ/aN2IvR3URsb3j28 DXhUNy3NkEPdNrMTpnQs1R3NeGNZ7ySVVzSznV6WWZa/2c214GpyfVEk317h+BNy 9RKeCmw7V/mSkRXVWqEEdC9kOHL11HuJRpGpORSxWHlozRYYHe+bUiVGv85zmCGo O4gv//4r69zUVyO9vwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTod7a9ca15a07f82bfd3b63020da38aa16
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark391144938
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stubb50b86d735412685eb6044ad8d01781c
ProcInject_AllocationMethodVirtualAllocEx
Total events
1 324
Read events
1 324
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
97
TCP/UDP connections
117
DNS requests
14
Threats
201

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
1828
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6984
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
6984
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
GET
200
47.99.72.48:9898
http://47.99.72.48:9898/cm
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
608
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
6260
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
47.99.72.48:9898
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1828
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1828
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
  • 52.183.220.149
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
www.microsoft.com
  • 23.218.209.163
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Fun Web Products Spyware User-Agent (FunWebProducts)
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
1164
c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
No debug info