Try VMRay Platform
Malicious
Classifications

Hacktool

Threat Names

Cobalt Strike Trojan.CobaltStrike.FM

Dynamic Analysis Report

Created on 2021-10-04T14:13:00

ee7932f9d6ace3828b43c63e727497e014931c1c2cb3c21f90065e4098e9e4c1.exe

Windows Exe (x86-32)
...

Remarks (1/1)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 hour, 39 minutes, 40 seconds" to "749.0 milliseconds" to reveal dormant functionality.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\ee7932f9d6ace3828b43c63e727497e014931c1c2cb3c21f90065e4098e9e4c1.exe Sample File Binary
malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 221.50 KB
MD5 2533b09300b21583d86192548e8282da Copy to Clipboard
SHA1 efb3112994506cafd748154479bb11b502c84a9f Copy to Clipboard
SHA256 ee7932f9d6ace3828b43c63e727497e014931c1c2cb3c21f90065e4098e9e4c1 Copy to Clipboard
SSDeep 3072:VPdi+x1PzNtFAQaHrWsjiwz8yHAK5cngVYN/o35PPpwy/+0hcn0GcPJOKAYZYSI/:9dJVtFAHrui9HAznUYupPPaWXxOy63 Copy to Clipboard
ImpHash 829da329ce140d873b4a8bde2cbfaa7e Copy to Clipboard
File Reputation Information
»
Verdict
malicious
AV Matches (1)
»
Threat Name Verdict
Trojan.CobaltStrike.FM
malicious
PE Information
»
Image Base 0x400000
Entry Point 0x409000
Size Of Code 0x36000
Size Of Initialized Data 0x7000
Size Of Uninitialized Data 0x1000
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2018-03-22 20:35:00+00:00
Sections (8)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x1ac4 0x1c00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.83
.data 0x403000 0x624 0x800 0x2000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.56
.rdata 0x404000 0x2d0 0x400 0x2800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ 4.23
.bss 0x405000 0x41c 0x0 0x2c00 IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.0
.idata 0x406000 0x630 0x800 0x2c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 4.14
.CRT 0x407000 0x34 0x200 0x3400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.27
.tls 0x408000 0x20 0x200 0x3600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.22
.vmvn 0x409000 0x33d08 0x33e00 0x3800 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.97
Imports (2)
»
KERNEL32.dll (26)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateThread - 0x40611c 0x3c894 0x37094 0xa7
DeleteCriticalSection - 0x406120 0x3c898 0x37098 0xc4
EnterCriticalSection - 0x406124 0x3c89c 0x3709c 0xdf
FreeLibrary - 0x406128 0x3c8a0 0x370a0 0x153
GetCurrentProcess - 0x40612c 0x3c8a4 0x370a4 0x1b1
GetCurrentProcessId - 0x406130 0x3c8a8 0x370a8 0x1b2
GetCurrentThreadId - 0x406134 0x3c8ac 0x370ac 0x1b5
GetLastError - 0x406138 0x3c8b0 0x370b0 0x1ee
GetModuleHandleA - 0x40613c 0x3c8b4 0x370b4 0x1fe
GetProcAddress - 0x406140 0x3c8b8 0x370b8 0x229
GetStartupInfoA - 0x406144 0x3c8bc 0x370bc 0x244
GetSystemTimeAsFileTime - 0x406148 0x3c8c0 0x370c0 0x25b
GetTickCount - 0x40614c 0x3c8c4 0x370c4 0x273
InitializeCriticalSection - 0x406150 0x3c8c8 0x370c8 0x2c6
LeaveCriticalSection - 0x406154 0x3c8cc 0x370cc 0x301
LoadLibraryA - 0x406158 0x3c8d0 0x370d0 0x303
LoadLibraryW - 0x40615c 0x3c8d4 0x370d4 0x306
QueryPerformanceCounter - 0x406160 0x3c8d8 0x370d8 0x367
SetUnhandledExceptionFilter - 0x406164 0x3c8dc 0x370dc 0x431
Sleep - 0x406168 0x3c8e0 0x370e0 0x43d
TerminateProcess - 0x40616c 0x3c8e4 0x370e4 0x449
TlsGetValue - 0x406170 0x3c8e8 0x370e8 0x450
UnhandledExceptionFilter - 0x406174 0x3c8ec 0x370ec 0x45d
VirtualAlloc - 0x406178 0x3c8f0 0x370f0 0x474
VirtualProtect - 0x40617c 0x3c8f4 0x370f4 0x47d
VirtualQuery - 0x406180 0x3c8f8 0x370f8 0x480
msvcrt.dll (28)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__dllonexit - 0x406188 0x3c900 0x37100 0x38
__getmainargs - 0x40618c 0x3c904 0x37104 0x3b
__initenv - 0x406190 0x3c908 0x37108 0x3c
__lconv_init - 0x406194 0x3c90c 0x3710c 0x45
__set_app_type - 0x406198 0x3c910 0x37110 0x69
__setusermatherr - 0x40619c 0x3c914 0x37114 0x6c
_acmdln - 0x4061a0 0x3c918 0x37118 0x7a
_amsg_exit - 0x4061a4 0x3c91c 0x3711c 0x8f
_cexit - 0x4061a8 0x3c920 0x37120 0xa0
_fmode - 0x4061ac 0x3c924 0x37124 0xfc
_initterm - 0x4061b0 0x3c928 0x37128 0x13d
_iob - 0x4061b4 0x3c92c 0x3712c 0x141
_lock - 0x4061b8 0x3c930 0x37130 0x1a5
_onexit - 0x4061bc 0x3c934 0x37134 0x247
_unlock - 0x4061c0 0x3c938 0x37138 0x2f5
_winmajor - 0x4061c4 0x3c93c 0x3713c 0x37b
abort - 0x4061c8 0x3c940 0x37140 0x3bd
calloc - 0x4061cc 0x3c944 0x37144 0x3cb
exit - 0x4061d0 0x3c948 0x37148 0x3d5
fprintf - 0x4061d4 0x3c94c 0x3714c 0x3e5
free - 0x4061d8 0x3c950 0x37150 0x3ec
fwrite - 0x4061dc 0x3c954 0x37154 0x3f7
malloc - 0x4061e0 0x3c958 0x37158 0x424
memcpy - 0x4061e4 0x3c95c 0x3715c 0x42c
signal - 0x4061e8 0x3c960 0x37160 0x449
strlen - 0x4061ec 0x3c964 0x37164 0x45d
strncmp - 0x4061f0 0x3c968 0x37168 0x460
vfprintf - 0x4061f4 0x3c96c 0x3716c 0x480
Memory Dumps (3)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point AV YARA Actions
ee7932f9d6ace3828b43c63e727497e014931c1c2cb3c21f90065e4098e9e4c1.exe 1 0x00400000 0x0043CFFF First Execution False 32-bit 0x00401710 False True
...
buffer 1 0x00950000 0x00B32FFF First Execution False 32-bit 0x0096527A False True
...
buffer 1 0x00950000 0x00B32FFF Content Changed False 32-bit 0x00975268 False False
...
c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\counters.dat Modified File Stream
clean
...
»
MIME Type application/octet-stream
File Size 128 Bytes
MD5 cc90851958032b8c8bbb7b24ec6271dd Copy to Clipboard
SHA1 e027ad2ea4049374a3b01af2e3626b667dc816bc Copy to Clipboard
SHA256 c2d814a34b184b7cdf10e4e7a4311ff15db99326d6dd8d328b53bf9e19ccf858 Copy to Clipboard
SSDeep 3:Fl: Copy to Clipboard
ImpHash -
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image