File name:

b868434f63e755cde6c30c9ca7fc37c0.exe

Full analysis: https://app.any.run/tasks/3a638df1-cbc7-41df-9753-215c8c854d01
Verdict: Malicious activity
Threats:

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.

Malware Trends Tracker     >>>
Analysis date: November 14, 2023, 18:31:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
meterpreter
cobaltstrike
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

B868434F63E755CDE6C30C9CA7FC37C0

SHA1:

7DCB6BB334F0465DA4D48B99873D9C54C709E848

SHA256:

CCD3670CA8758D4F9AC1CD1642AE94348A325B8836716C0C2195C56ED065D714

SSDEEP:

192:HauHqWj7G4m1ajJAQa7LC+QWLfFCAZlYYqnND6ZIc1j3nptL7GbUaYnCrUR1p7g5:SWXGaNp+QWAClYRxs1n7GbUanrUPYD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • COBALTSTRIKE has been detected (YARA)

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • METERPRETER has been detected (SURICATA)

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

  • SUSPICIOUS

    • Reads the Internet Settings

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Reads security settings of Internet Explorer

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Reads settings of System Certificates

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Checks Windows Trust Settings

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Connects to unusual port

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

  • INFO

    • Checks proxy server information

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Checks supported languages

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Reads the computer name

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Reads the machine GUID from the registry

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)

    • Create files in a temporary directory

      • b868434f63e755cde6c30c9ca7fc37c0.exe (PID: 2584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(2584) b868434f63e755cde6c30c9ca7fc37c0.exe
C2103.185.249.119:4434/fFLe
HeadersUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)
C2 (1)103.185.249.119/j.ad
BeaconTypeHTTPS
Port4434
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUOeznos6ya2nACsIsPHpJi7GO dF6/h+YbrW8NV0i/Pccwfq+Mubovri4EnNFJCW5AbXYVG369RQ//qsDjMruUiodJ rgmpNFdBgTCjoxyNHojhzCQhF8mtPl95P+Q0PaHjDOrRJUr+A5TQwPCibfCnvLRs jldIqpkIR0ceeHCqnwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTo00000000000000000000000000000000
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark987654321
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stube43a1b63f09794f74d90a9889f7acb77
ProcInject_AllocationMethodVirtualAllocEx
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.2)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.34
CodeSize: 8704
InitializedDataSize: 18432
UninitializedDataSize: 2560
EntryPoint: 0x14c0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #COBALTSTRIKE b868434f63e755cde6c30c9ca7fc37c0.exe

Process information

PID
CMD
Path
Indicators
Parent process
2584"C:\Users\admin\AppData\Local\Temp\b868434f63e755cde6c30c9ca7fc37c0.exe" C:\Users\admin\AppData\Local\Temp\b868434f63e755cde6c30c9ca7fc37c0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b868434f63e755cde6c30c9ca7fc37c0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
CobalStrike
(PID) Process(2584) b868434f63e755cde6c30c9ca7fc37c0.exe
C2103.185.249.119:4434/fFLe
HeadersUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)
(PID) Process(2584) b868434f63e755cde6c30c9ca7fc37c0.exe
C2 (1)103.185.249.119/j.ad
BeaconTypeHTTPS
Port4434
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUOeznos6ya2nACsIsPHpJi7GO dF6/h+YbrW8NV0i/Pccwfq+Mubovri4EnNFJCW5AbXYVG369RQ//qsDjMruUiodJ rgmpNFdBgTCjoxyNHojhzCQhF8mtPl95P+Q0PaHjDOrRJUr+A5TQwPCibfCnvLRs jldIqpkIR0ceeHCqnwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTo00000000000000000000000000000000
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark987654321
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stube43a1b63f09794f74d90a9889f7acb77
ProcInject_AllocationMethodVirtualAllocEx
Total events
943
Read events
917
Write events
26
Delete events
0

Modification events

(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2584) b868434f63e755cde6c30c9ca7fc37c0.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2584b868434f63e755cde6c30c9ca7fc37c0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2584b868434f63e755cde6c30c9ca7fc37c0.exeC:\Users\admin\AppData\Local\Temp\TarABC8.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
2584b868434f63e755cde6c30c9ca7fc37c0.exeC:\Users\admin\AppData\Local\Temp\CabABC7.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2584b868434f63e755cde6c30c9ca7fc37c0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:8CA8BD293C9F70D88ADE77B77BE197FE
SHA256:55836F7D92D1D78EDB2A3AB37F6D39C0B7D98DC319D0A764CD5BDED945B98903
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
11
DNS requests
1
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
GET
200
8.253.95.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bc94162ffeea0ca3
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
103.185.249.119:4434
—
GA Cloud
HK
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
8.253.95.120:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 8.253.95.120
  • 8.241.11.254
  • 67.26.73.254
  • 8.248.119.254
  • 67.26.139.254
whitelisted

Threats

PID
Process
Class
Message
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
Targeted Malicious Activity was Detected
ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
A Network Trojan was detected
ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
A Network Trojan was detected
ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
Targeted Malicious Activity was Detected
ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
Targeted Malicious Activity was Detected
ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike
2584
b868434f63e755cde6c30c9ca7fc37c0.exe
A Network Trojan was detected
ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b868434f63e755cde6c30c9ca7fc37c0.exe