File name: | cbot.exe |
Full analysis: | https://app.any.run/tasks/52d8d2cd-ad9f-4739-9490-a0376bff5b9b |
Verdict: | Malicious activity |
Analysis date: | January 11, 2025, 00:55:06 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32+ executable (GUI) x86-64, for MS Windows, 3 sections |
MD5: | 800DCB9F93715F5ED7189BE2E35AEBD9 |
SHA1: | 5D0A60C1E85BED844BB98A864C04D87E1B66C76D |
SHA256: | CFF151AB7A8C0D221278758E76F71FC6C120D22BC39BF98DAABFE1F450642A6F |
SSDEEP: | 3072:CRXrzuc3ntlUhnxMEBdUDqoE4/VS52cjaJizO9yDgDHbMfqTi6:CRRlcxzdUDqOq74i8yDk5i6 |
.exe | | | Win64 Executable (generic) (47) |
---|---|---|
.exe | | | UPX compressed Win32 Executable (46.1) |
.exe | | | Generic Win/DOS Executable (3.4) |
.exe | | | DOS Executable Generic (3.4) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5.2 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x7fbd0 |
UninitializedDataSize: | 421888 |
InitializedDataSize: | 4096 |
CodeSize: | 102400 |
LinkerVersion: | 2.38 |
PEType: | PE32+ |
ImageFileCharacteristics: | Executable, No line numbers, Large address aware |
TimeStamp: | 2025:01:09 16:09:02+00:00 |
MachineType: | AMD AMD64 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6228 | "C:\Users\admin\AppData\Local\Temp\cbot.exe" | C:\Users\admin\AppData\Local\Temp\cbot.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
6228 | cbot.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe | executable | |
MD5:800DCB9F93715F5ED7189BE2E35AEBD9 | SHA256:CFF151AB7A8C0D221278758E76F71FC6C120D22BC39BF98DAABFE1F450642A6F | |||
6228 | cbot.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbot.exe | executable | |
MD5:800DCB9F93715F5ED7189BE2E35AEBD9 | SHA256:CFF151AB7A8C0D221278758E76F71FC6C120D22BC39BF98DAABFE1F450642A6F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
6984 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6984 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6328 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5064 | SearchApp.exe | 2.16.204.161:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2040 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
6228 | cbot.exe | 154.213.192.42:3778 | — | MULTA-ASN1 | HK | unknown |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |