Edit tour

Windows Analysis Report
c_shlellcode.exe

Overview

General Information

Sample name:	c_shlellcode.exe
Analysis ID:	1585850
MD5:	3e96c0115aeac2b89d926f326079fdc0
SHA1:	a89bb148add8feaa7722fb050bb6b60a1ba00fa3
SHA256:	e6cf1ddc88cf5b00cc2104cd0d9b87bc9f69674594d256dcc3da9ecc95da16fc
Tags:	CobaltStrikeexeuser-kafan_shengui
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

Process Tree

System is w10x64

c_shlellcode.exe (PID: 7116 cmdline: "C:\Users\user\Desktop\c_shlellcode.exe" MD5: 3E96C0115AEAC2B89D926F326079FDC0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 18443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "111.119.200.175,/updates.rss", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 666666666, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x31023:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3109b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31800:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31b32:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31ac4:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31b32:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x310fe:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3128f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x31144:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31182:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31b7c:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x313ea:$a11: Could not open service control manager on %s: %d 0x3191c:$a12: %d is an x64 process (can't inject x86 content) 0x3194c:$a13: %d is an x86 process (can't inject x64 content) 0x31c6d:$a14: Failed to impersonate logged on user %d (%u) 0x318d5:$a15: could not create remote thread in %d: %d 0x311b8:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31883:$a17: could not write to process memory: %d 0x3141b:$a18: Could not create service %s on %s: %d 0x314a4:$a19: Could not delete service %s on %s: %d 0x31309:$a20: Could not open process token: %d (%u)
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cdbc:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x189ea:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19d1b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x40271:$loader_export: ReflectiveLoader 0x30fe0:$exportname: beacon.dll
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31b7c:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x3194c:$x2: %d is an x86 process (can't inject x64 content) 0x31b32:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31c16:$x4: Failed to impersonate token from %d (%u) 0x31c6d:$x5: Failed to impersonate logged on user %d (%u) 0x31023:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1994a:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x18cee:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x31043:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310bb:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31820:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31b52:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31ae4:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31b52:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3111e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x312af:$a7: could not run command (w/ token) because of its length of %d bytes! 0x31164:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x311a2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31b9c:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3140a:$a11: Could not open service control manager on %s: %d 0x3193c:$a12: %d is an x64 process (can't inject x86 content) 0x3196c:$a13: %d is an x86 process (can't inject x64 content) 0x31c8d:$a14: Failed to impersonate logged on user %d (%u) 0x318f5:$a15: could not create remote thread in %d: %d 0x311d8:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x318a3:$a17: could not write to process memory: %d 0x3143b:$a18: Could not create service %s on %s: %d 0x314c4:$a19: Could not delete service %s on %s: %d 0x31329:$a20: Could not open process token: %d (%u)
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cddc:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x18a0a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19d3b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x40291:$loader_export: ReflectiveLoader 0x31000:$exportname: beacon.dll
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31b9c:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x3196c:$x2: %d is an x86 process (can't inject x64 content) 0x31b52:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31c36:$x4: Failed to impersonate token from %d (%u) 0x31c8d:$x5: Failed to impersonate logged on user %d (%u) 0x31043:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1996a:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x18d0e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
Process Memory Space: c_shlellcode.exe PID: 7116	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: c_shlellcode.exe PID: 7116	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: c_shlellcode.exe PID: 7116	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: c_shlellcode.exe PID: 7116	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: c_shlellcode.exe PID: 7116	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: c_shlellcode.exe PID: 7116	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x1088:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1380c8:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14ab0f:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1100:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x138140:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14ab87:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1865:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x1388a5:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x14b2ec:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x1b8d:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x138bcd:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x14b614:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x1b1f:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x1b8d:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x138b5f:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x138bcd:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x14b5a6:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x14b614:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x1163:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1381a3:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14abea:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: c_shlellcode.exe PID: 7116	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x61bb:$loader_export: ReflectiveLoader 0x61da:$loader_export: ReflectiveLoader 0x13d1fb:$loader_export: ReflectiveLoader 0x13d21a:$loader_export: ReflectiveLoader 0x14fc42:$loader_export: ReflectiveLoader 0x14fc61:$loader_export: ReflectiveLoader 0xec4:$exportname: beacon.dll 0x104d:$exportname: beacon.dll 0x137f04:$exportname: beacon.dll 0x13808d:$exportname: beacon.dll 0x14a94b:$exportname: beacon.dll 0x14aad4:$exportname: beacon.dll
Process Memory Space: c_shlellcode.exe PID: 7116	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2982:$str1: %s (admin) 0x2a02:$str1: %s (admin) 0x1399c2:$str1: %s (admin) 0x139a42:$str1: %s (admin) 0x14c409:$str1: %s (admin) 0x14c489:$str1: %s (admin) 0xec4:$str2: beacon.dll 0x104d:$str2: beacon.dll 0x137f04:$str2: beacon.dll 0x13808d:$str2: beacon.dll 0x14a94b:$str2: beacon.dll 0x14aad4:$str2: beacon.dll
Process Memory Space: c_shlellcode.exe PID: 7116	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x1bd7:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x138c17:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x14b65e:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x19b1:$x2: %d is an x86 process (can't inject x64 content) 0x1389f1:$x2: %d is an x86 process (can't inject x64 content) 0x14b438:$x2: %d is an x86 process (can't inject x64 content) 0x1b8d:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x138bcd:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x14b614:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x1c71:$x4: Failed to impersonate token from %d (%u) 0x138cb1:$x4: Failed to impersonate token from %d (%u) 0x14b6f8:$x4: Failed to impersonate token from %d (%u) 0x1cc8:$x5: Failed to impersonate logged on user %d (%u) 0x138d08:$x5: Failed to impersonate logged on user %d (%u) 0x14b74f:$x5: Failed to impersonate logged on user %d (%u) 0x1088:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1380c8:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x14ab0f:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: c_shlellcode.exe PID: 7116	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x1b65:$s1: %%IMPORT%% 0x138ba5:$s1: %%IMPORT%% 0x14b5ec:$s1: %%IMPORT%% 0x106c:$s2: www6.%x%x.%s 0x1380ac:$s2: www6.%x%x.%s 0x14aaf3:$s2: www6.%x%x.%s 0x1060:$s3: cdn.%x%x.%s 0x1380a0:$s3: cdn.%x%x.%s 0x14aae7:$s3: cdn.%x%x.%s 0x12e8:$s4: api.%x%x.%s 0x138328:$s4: api.%x%x.%s 0x14ad6f:$s4: api.%x%x.%s 0x2982:$s5: %s (admin) 0x2a02:$s5: %s (admin) 0x1399c2:$s5: %s (admin) 0x139a42:$s5: %s (admin) 0x14c409:$s5: %s (admin) 0x14c489:$s5: %s (admin) 0x1357:$s6: could not spawn %s: %d 0x138397:$s6: could not spawn %s: %d 0x14adde:$s6: could not spawn %s: %d
Click to see the 36 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.c_shlellcode.exe.1bcf9b60000.0.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
Click to see the 18 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T11:06:07.290596+0100	2028765	3	Unknown Traffic	192.168.2.6	49709	111.119.200.175	18443	TCP
2025-01-08T11:06:11.546982+0100	2028765	3	Unknown Traffic	192.168.2.6	49713	111.119.200.175	18443	TCP
2025-01-08T11:06:15.793084+0100	2028765	3	Unknown Traffic	192.168.2.6	49722	111.119.200.175	18443	TCP
2025-01-08T11:06:20.194483+0100	2028765	3	Unknown Traffic	192.168.2.6	49751	111.119.200.175	18443	TCP
2025-01-08T11:06:24.455613+0100	2028765	3	Unknown Traffic	192.168.2.6	49788	111.119.200.175	18443	TCP
2025-01-08T11:06:28.687808+0100	2028765	3	Unknown Traffic	192.168.2.6	49819	111.119.200.175	18443	TCP
2025-01-08T11:06:32.954691+0100	2028765	3	Unknown Traffic	192.168.2.6	49850	111.119.200.175	18443	TCP
2025-01-08T11:06:37.264398+0100	2028765	3	Unknown Traffic	192.168.2.6	49877	111.119.200.175	18443	TCP
2025-01-08T11:06:41.561225+0100	2028765	3	Unknown Traffic	192.168.2.6	49907	111.119.200.175	18443	TCP
2025-01-08T11:06:45.816095+0100	2028765	3	Unknown Traffic	192.168.2.6	49937	111.119.200.175	18443	TCP
2025-01-08T11:06:50.080727+0100	2028765	3	Unknown Traffic	192.168.2.6	49968	111.119.200.175	18443	TCP
2025-01-08T11:06:54.343088+0100	2028765	3	Unknown Traffic	192.168.2.6	50001	111.119.200.175	18443	TCP
2025-01-08T11:06:58.594089+0100	2028765	3	Unknown Traffic	192.168.2.6	50019	111.119.200.175	18443	TCP
2025-01-08T11:07:02.844226+0100	2028765	3	Unknown Traffic	192.168.2.6	50023	111.119.200.175	18443	TCP
2025-01-08T11:07:07.095041+0100	2028765	3	Unknown Traffic	192.168.2.6	50026	111.119.200.175	18443	TCP
2025-01-08T11:07:11.348646+0100	2028765	3	Unknown Traffic	192.168.2.6	50030	111.119.200.175	18443	TCP
2025-01-08T11:07:15.611478+0100	2028765	3	Unknown Traffic	192.168.2.6	50033	111.119.200.175	18443	TCP
2025-01-08T11:07:19.843146+0100	2028765	3	Unknown Traffic	192.168.2.6	50036	111.119.200.175	18443	TCP
2025-01-08T11:07:24.079139+0100	2028765	3	Unknown Traffic	192.168.2.6	50039	111.119.200.175	18443	TCP
2025-01-08T11:07:28.314430+0100	2028765	3	Unknown Traffic	192.168.2.6	50043	111.119.200.175	18443	TCP
2025-01-08T11:07:32.564423+0100	2028765	3	Unknown Traffic	192.168.2.6	50046	111.119.200.175	18443	TCP
2025-01-08T11:07:36.812047+0100	2028765	3	Unknown Traffic	192.168.2.6	50050	111.119.200.175	18443	TCP
2025-01-08T11:07:41.067674+0100	2028765	3	Unknown Traffic	192.168.2.6	50053	111.119.200.175	18443	TCP
2025-01-08T11:07:45.297024+0100	2028765	3	Unknown Traffic	192.168.2.6	50056	111.119.200.175	18443	TCP
2025-01-08T11:07:49.569308+0100	2028765	3	Unknown Traffic	192.168.2.6	50059	111.119.200.175	18443	TCP
2025-01-08T11:07:53.798141+0100	2028765	3	Unknown Traffic	192.168.2.6	50062	111.119.200.175	18443	TCP
2025-01-08T11:07:58.030076+0100	2028765	3	Unknown Traffic	192.168.2.6	50065	111.119.200.175	18443	TCP
2025-01-08T11:08:02.426285+0100	2028765	3	Unknown Traffic	192.168.2.6	50069	111.119.200.175	18443	TCP
2025-01-08T11:08:06.670631+0100	2028765	3	Unknown Traffic	192.168.2.6	50072	111.119.200.175	18443	TCP
2025-01-08T11:08:10.906925+0100	2028765	3	Unknown Traffic	192.168.2.6	50075	111.119.200.175	18443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: c_shlellcode.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 18443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "111.119.200.175,/updates.rss", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 666666666, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: c_shlellcode.exe	Virustotal: Detection: 25%			Perma Link
Source: c_shlellcode.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: c_shlellcode.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 111.119.200.175

Source: global traffic

TCP traffic: 192.168.2.6:49709 -> 111.119.200.175:18443

Source: Joe Sandbox View

ASN Name: SIPL-ASSysconInfowayPvtLtdIN SIPL-ASSysconInfowayPvtLtdIN

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49713 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49709 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49722 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49788 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49751 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49819 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49850 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49877 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49907 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49968 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50019 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50023 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50039 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50053 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50026 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50059 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50062 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50069 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50056 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50030 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50072 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50046 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50050 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50036 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50033 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50043 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50065 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50075 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50001 -> 111.119.200.175:18443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49937 -> 111.119.200.175:18443

Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175
Source: unknown	TCP traffic detected without corresponding DNS query: 111.119.200.175

Source: c_shlellcode.exe, 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175/
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/.0;
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/200.175:18443/updates.rss
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/200.175:18443/updates.rssv
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/ent/5.0;
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF998F000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF99C0000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rss
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rssA
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rssZPH
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF99C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rssings
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rssrPP
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rsstP
Source: c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://111.119.200.175:18443/updates.rssy

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: CobaltStrike payload Author: ditekSHen

Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: c_shlellcode.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\c_shlellcode.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: c_shlellcode.exe	Virustotal: Detection: 25%
Source: c_shlellcode.exe	ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\c_shlellcode.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\c_shlellcode.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: c_shlellcode.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: c_shlellcode.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: c_shlellcode.exe

Static file information: File size 5593088 > 1048576

Source: c_shlellcode.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x347e00
Source: c_shlellcode.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1f9a00

Source: c_shlellcode.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: c_shlellcode.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: c_shlellcode.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: c_shlellcode.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: c_shlellcode.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: c_shlellcode.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: c_shlellcode.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: c_shlellcode.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: c_shlellcode.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: c_shlellcode.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: c_shlellcode.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: c_shlellcode.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: c_shlellcode.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\c_shlellcode.exe TID: 3784

Thread sleep time: -1740000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\c_shlellcode.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\c_shlellcode.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\c_shlellcode.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: c_shlellcode.exe, 00000000.00000002.3386064423.000001BCF97FD000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR

Source: C:\Users\user\Desktop\c_shlellcode.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: c_shlellcode.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.c_shlellcode.exe.1bcf9b60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c_shlellcode.exe.1bcf9b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
c_shlellcode.exe	25%	Virustotal		Browse
c_shlellcode.exe	16%	ReversingLabs	Win64.Trojan.BeaconMarte
c_shlellcode.exe	100%	Avira	HEUR/AGEN.1318781

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://111.119.200.175:18443/	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rssA	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/200.175:18443/updates.rssv	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rss	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rssy	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/.0;	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rssrPP	0%	Avira URL Cloud	safe
https://111.119.200.175/	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rssZPH	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rssings	0%	Avira URL Cloud	safe
111.119.200.175	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/200.175:18443/updates.rss	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/updates.rsstP	0%	Avira URL Cloud	safe
https://111.119.200.175:18443/ent/5.0;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
111.119.200.175	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://111.119.200.175:18443/	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rssA	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/.0;	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/200.175:18443/updates.rssv	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rssy	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rssrPP	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rss	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF998F000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF99C0000.00000004.00000020.00020000.00000000.sdmp, c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rssZPH	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175/	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rssings	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF99C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:%u/	c_shlellcode.exe, 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp	false		high
https://111.119.200.175:18443/200.175:18443/updates.rss	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/updates.rsstP	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF999D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://111.119.200.175:18443/ent/5.0;	c_shlellcode.exe, 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
111.119.200.175	unknown	India		45194	SIPL-ASSysconInfowayPvtLtdIN	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585850
Start date and time:	2025-01-08 11:05:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c_shlellcode.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:06:08	API Interceptor	29x Sleep call for process: c_shlellcode.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIPL-ASSysconInfowayPvtLtdIN	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	160.22.201.149
	Hilix.x86.elf	Get hash	malicious	Mirai	Browse	45.117.212.14
	armv7l.elf	Get hash	malicious	Unknown	Browse	160.21.14.112
	hmips.elf	Get hash	malicious	Mirai	Browse	160.21.176.231
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	160.22.166.105
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	160.22.121.182
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	160.21.29.33
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	160.22.199.61
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	183.87.70.106
	i486.elf	Get hash	malicious	Mirai	Browse	160.22.118.22

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.620101170481614
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	c_shlellcode.exe
File size:	5'593'088 bytes
MD5:	3e96c0115aeac2b89d926f326079fdc0
SHA1:	a89bb148add8feaa7722fb050bb6b60a1ba00fa3
SHA256:	e6cf1ddc88cf5b00cc2104cd0d9b87bc9f69674594d256dcc3da9ecc95da16fc
SHA512:	c3d9399e6654f69a0ab5db00953dd28983084eafb4eb8d9f6daf52394f898811eca75e81e1e6ac6a375cfe8fd581148d281a1a5c5049f46c82a6bb3283db2601
SSDEEP:	98304:Opmw8u6dz3TnvMMMMMMSQMMMMMMqiMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMh:Opz8LJj
TLSH:	8546F5218E3F61E0E56A3F72C8B7A46FC71E6F609356D4D16BE434870637A62E15CCA0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..Qn.x.n.x.n.x.%.{.h.x.%.}...x.%.\|.~.x..C{.d.x..C\|.~.x..C}.<.x.%.y.m.x.n.y...x..C}.o.x..C..o.x..Cz.o.x.Richn.x................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1403288ac
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x677D2EFB [Tue Jan 7 13:41:15 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ac3973a69755a7d751cb90349483f62d

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F786CE0977Ch
dec eax
add esp, 28h
jmp 00007F786CE08DA7h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007F786CE08F41h
dec eax
mov ecx, ebx
call 00007F786CE1685Eh
test eax, eax
je 00007F786CE08F45h
dec eax
mov ecx, ebx
call 00007F786CE1287Eh
dec eax
test eax, eax
je 00007F786CE08F19h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007F786CE08F38h
call 00007F786CE05EF4h
int3
call 00007F786CE09ACAh
int3
jmp 00007F786CE09AE4h
int3
int3
int3
dec eax
sub esp, 28h
call 00007F786CE09AE0h
test eax, eax
je 00007F786CE08F53h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F786CE08F37h
dec eax
cmp ecx, eax
je 00007F786CE08F46h
xor eax, eax
dec eax
cmpxchg dword ptr [00031E20h], ecx
jne 00007F786CE08F20h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F786CE08F29h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F786CE08F39h
mov byte ptr [00031E09h], 00000001h
call 00007F786CE09411h
call 00007F786CE0AF34h
test al, al
jne 00007F786CE08F36h
xor al, al
jmp 00007F786CE08F46h
call 00007F786CE16D7Bh
test al, al
jne 00007F786CE08F3Bh
xor ecx, ecx
call 00007F786CE0AF44h
jmp 00007F786CE08F1Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x357dc4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35f000	0x1f9808	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x35c000	0x273c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x559000	0x938	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3542b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x354480	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x354170	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x349000	0x2e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x347dc4	0x347e00	d200e01b90d1929dea134f71098bf124	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x349000	0xf788	0xf800	48828846ca66669aae69ec84258e90c3	False	0.4185672883064516	data	4.91659459017448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x359000	0x2a20	0x1200	596db483a36b5a246b304f40384bf833	False	0.1736111111111111	data	2.8441863096632924	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x35c000	0x273c	0x2800	8c4ac94a314a34e48f9f3285f3d85add	False	0.476171875	data	5.491342301571783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x35f000	0x1f9808	0x1f9a00	96f60c36a393c205e5cd69b13f51c84b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x559000	0x938	0xa00	a435dc0bb531f084139b014157d6c298	False	0.489453125	data	5.284777266639493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x35f060	0x1f97a8	Device independent bitmap graphic, 862 x 800 x 24, image size 0, resolution 4724 x 4724 px/m	Chinese	China	0.10166549682617188

Imports

DLL

Import

KERNEL32.dll

HeapCreate, HeapAlloc, GetCurrentProcess, CreateThread, FlushInstructionCache, GetModuleHandleW, GetProcAddress, WriteConsoleW, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, GetCPInfo, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, TerminateProcess, RtlPcToFileHeader, RaiseException, RtlUnwindEx, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, CreateFileW, RtlUnwind

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T11:06:07.290596+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49709	111.119.200.175	18443	TCP
2025-01-08T11:06:11.546982+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49713	111.119.200.175	18443	TCP
2025-01-08T11:06:15.793084+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49722	111.119.200.175	18443	TCP
2025-01-08T11:06:20.194483+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49751	111.119.200.175	18443	TCP
2025-01-08T11:06:24.455613+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49788	111.119.200.175	18443	TCP
2025-01-08T11:06:28.687808+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49819	111.119.200.175	18443	TCP
2025-01-08T11:06:32.954691+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49850	111.119.200.175	18443	TCP
2025-01-08T11:06:37.264398+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49877	111.119.200.175	18443	TCP
2025-01-08T11:06:41.561225+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49907	111.119.200.175	18443	TCP
2025-01-08T11:06:45.816095+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49937	111.119.200.175	18443	TCP
2025-01-08T11:06:50.080727+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49968	111.119.200.175	18443	TCP
2025-01-08T11:06:54.343088+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50001	111.119.200.175	18443	TCP
2025-01-08T11:06:58.594089+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50019	111.119.200.175	18443	TCP
2025-01-08T11:07:02.844226+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50023	111.119.200.175	18443	TCP
2025-01-08T11:07:07.095041+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50026	111.119.200.175	18443	TCP
2025-01-08T11:07:11.348646+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50030	111.119.200.175	18443	TCP
2025-01-08T11:07:15.611478+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50033	111.119.200.175	18443	TCP
2025-01-08T11:07:19.843146+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50036	111.119.200.175	18443	TCP
2025-01-08T11:07:24.079139+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50039	111.119.200.175	18443	TCP
2025-01-08T11:07:28.314430+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50043	111.119.200.175	18443	TCP
2025-01-08T11:07:32.564423+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50046	111.119.200.175	18443	TCP
2025-01-08T11:07:36.812047+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50050	111.119.200.175	18443	TCP
2025-01-08T11:07:41.067674+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50053	111.119.200.175	18443	TCP
2025-01-08T11:07:45.297024+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50056	111.119.200.175	18443	TCP
2025-01-08T11:07:49.569308+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50059	111.119.200.175	18443	TCP
2025-01-08T11:07:53.798141+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50062	111.119.200.175	18443	TCP
2025-01-08T11:07:58.030076+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50065	111.119.200.175	18443	TCP
2025-01-08T11:08:02.426285+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50069	111.119.200.175	18443	TCP
2025-01-08T11:08:06.670631+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50072	111.119.200.175	18443	TCP
2025-01-08T11:08:10.906925+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50075	111.119.200.175	18443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 11:06:05.214843035 CET	49709	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:05.219635010 CET	18443	49709	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:05.219723940 CET	49709	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:05.228331089 CET	49709	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:05.233087063 CET	18443	49709	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:07.290504932 CET	18443	49709	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:07.290596008 CET	49709	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:07.290735960 CET	49709	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:07.291233063 CET	49711	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:07.295511961 CET	18443	49709	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:07.296035051 CET	18443	49711	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:07.296099901 CET	49711	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:07.296336889 CET	49711	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:07.301104069 CET	18443	49711	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:09.363903999 CET	18443	49711	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:09.363970041 CET	49711	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.364339113 CET	49711	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.364528894 CET	49712	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.369133949 CET	18443	49711	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:09.369350910 CET	18443	49712	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:09.369417906 CET	49712	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.369565010 CET	49712	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.374382973 CET	18443	49712	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:09.374430895 CET	49712	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.474889040 CET	49713	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.479747057 CET	18443	49713	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:09.479844093 CET	49713	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.480176926 CET	49713	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:09.485025883 CET	18443	49713	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:11.546891928 CET	18443	49713	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:11.546982050 CET	49713	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:11.548959970 CET	49713	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:11.550649881 CET	49714	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:11.553791046 CET	18443	49713	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:11.555466890 CET	18443	49714	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:11.555540085 CET	49714	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:11.568377018 CET	49714	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:11.573185921 CET	18443	49714	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:13.627902031 CET	18443	49714	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:13.627973080 CET	49714	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.628040075 CET	49714	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.628525019 CET	49721	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.632805109 CET	18443	49714	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:13.633268118 CET	18443	49721	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:13.633440018 CET	49721	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.633588076 CET	49721	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.638427973 CET	18443	49721	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:13.638493061 CET	49721	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.740494013 CET	49722	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.745266914 CET	18443	49722	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:13.745325089 CET	49722	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.745610952 CET	49722	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:13.750351906 CET	18443	49722	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:15.793018103 CET	18443	49722	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:15.793083906 CET	49722	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:15.793167114 CET	49722	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:15.793648005 CET	49737	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:15.797903061 CET	18443	49722	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:15.798388958 CET	18443	49737	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:15.798449993 CET	49737	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:15.798688889 CET	49737	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:15.803442001 CET	18443	49737	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:17.861895084 CET	18443	49737	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:17.862032890 CET	49737	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.862308025 CET	49737	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.862926006 CET	49750	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.867086887 CET	18443	49737	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:17.867785931 CET	18443	49750	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:17.868038893 CET	49750	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.868133068 CET	49750	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.873034954 CET	18443	49750	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:17.873085022 CET	49750	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.977165937 CET	49751	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.981971979 CET	18443	49751	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:17.982086897 CET	49751	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.982291937 CET	49751	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:17.987109900 CET	18443	49751	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:20.194403887 CET	18443	49751	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:20.194483042 CET	49751	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:20.194605112 CET	49751	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:20.195244074 CET	49767	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:20.199600935 CET	18443	49751	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:20.200056076 CET	18443	49767	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:20.200150013 CET	49767	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:20.200539112 CET	49767	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:20.205282927 CET	18443	49767	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:22.266381979 CET	18443	49767	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:22.266513109 CET	49767	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.266649008 CET	49767	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.267282009 CET	49786	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.271420002 CET	18443	49767	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:22.272072077 CET	18443	49786	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:22.272289991 CET	49786	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.272396088 CET	49786	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.277605057 CET	18443	49786	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:22.277659893 CET	49786	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.381110907 CET	49788	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.386126041 CET	18443	49788	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:22.386205912 CET	49788	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.386559010 CET	49788	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:22.391326904 CET	18443	49788	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:24.455457926 CET	18443	49788	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:24.455612898 CET	49788	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:24.455697060 CET	49788	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:24.459578991 CET	49803	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:24.460474968 CET	18443	49788	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:24.464432001 CET	18443	49803	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:24.464618921 CET	49803	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:24.464843035 CET	49803	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:24.469650984 CET	18443	49803	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.515157938 CET	18443	49803	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.515223026 CET	49803	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.515331984 CET	49803	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.515984058 CET	49816	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.520117044 CET	18443	49803	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.520737886 CET	18443	49816	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.520796061 CET	49816	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.520901918 CET	49816	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.525685072 CET	18443	49816	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.525958061 CET	18443	49816	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.526006937 CET	49816	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.631053925 CET	49819	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.635894060 CET	18443	49819	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:26.635968924 CET	49819	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.636236906 CET	49819	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:26.640995979 CET	18443	49819	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:28.687679052 CET	18443	49819	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:28.687808037 CET	49819	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:28.687901020 CET	49819	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:28.688390017 CET	49833	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:28.692681074 CET	18443	49819	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:28.693229914 CET	18443	49833	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:28.693314075 CET	49833	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:28.694359064 CET	49833	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:28.699127913 CET	18443	49833	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:30.768124104 CET	18443	49833	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:30.768237114 CET	49833	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.768321037 CET	49833	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.768846035 CET	49849	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.773052931 CET	18443	49833	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:30.773663044 CET	18443	49849	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:30.773732901 CET	49849	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.773853064 CET	49849	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.778790951 CET	18443	49849	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:30.778856993 CET	49849	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.882297993 CET	49850	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.887131929 CET	18443	49850	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:30.887232065 CET	49850	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.887484074 CET	49850	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:30.892282009 CET	18443	49850	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:32.954606056 CET	18443	49850	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:32.954690933 CET	49850	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:32.954771996 CET	49850	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:32.955226898 CET	49863	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:32.960238934 CET	18443	49850	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:32.960732937 CET	18443	49863	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:32.960799932 CET	49863	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:32.961110115 CET	49863	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:32.966938019 CET	18443	49863	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:35.046350002 CET	18443	49863	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:35.046437025 CET	49863	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.046508074 CET	49863	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.047733068 CET	49875	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.051284075 CET	18443	49863	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:35.052561998 CET	18443	49875	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:35.052623987 CET	49875	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.052737951 CET	49875	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.057554007 CET	18443	49875	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:35.057598114 CET	49875	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.162826061 CET	49877	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.167634964 CET	18443	49877	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:35.167700052 CET	49877	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.169147015 CET	49877	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:35.173907995 CET	18443	49877	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:37.264280081 CET	18443	49877	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:37.264398098 CET	49877	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:37.327601910 CET	49877	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:37.328641891 CET	49890	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:37.332437992 CET	18443	49877	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:37.333447933 CET	18443	49890	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:37.333507061 CET	49890	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:37.376315117 CET	49890	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:37.381076097 CET	18443	49890	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:39.389239073 CET	18443	49890	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:39.389357090 CET	49890	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.389425039 CET	49890	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.389825106 CET	49906	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.394200087 CET	18443	49890	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:39.394680977 CET	18443	49906	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:39.394737959 CET	49906	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.394803047 CET	49906	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.399776936 CET	18443	49906	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:39.402369022 CET	49906	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.506069899 CET	49907	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.510919094 CET	18443	49907	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:39.511014938 CET	49907	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.511369944 CET	49907	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:39.518311024 CET	18443	49907	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:41.561141014 CET	18443	49907	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:41.561224937 CET	49907	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:41.561343908 CET	49907	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:41.561816931 CET	49920	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:41.566128016 CET	18443	49907	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:41.566636086 CET	18443	49920	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:41.566703081 CET	49920	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:41.566905022 CET	49920	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:41.571672916 CET	18443	49920	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:43.625844002 CET	18443	49920	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:43.625901937 CET	49920	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.625978947 CET	49920	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.626351118 CET	49936	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.630781889 CET	18443	49920	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:43.631122112 CET	18443	49936	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:43.631186962 CET	49936	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.631602049 CET	49936	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.636404037 CET	18443	49936	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:43.636482000 CET	49936	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.741489887 CET	49937	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.746388912 CET	18443	49937	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:43.746481895 CET	49937	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.746710062 CET	49937	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:43.751530886 CET	18443	49937	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:45.815625906 CET	18443	49937	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:45.816095114 CET	49937	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:45.816167116 CET	49937	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:45.816682100 CET	49953	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:45.820951939 CET	18443	49937	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:45.821424961 CET	18443	49953	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:45.821528912 CET	49953	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:45.821849108 CET	49953	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:45.826698065 CET	18443	49953	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:47.887206078 CET	18443	49953	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:47.888045073 CET	49953	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:47.888124943 CET	49953	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:47.888569117 CET	49967	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:47.892889977 CET	18443	49953	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:47.893424034 CET	18443	49967	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:47.893491030 CET	49967	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:47.893635035 CET	49967	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:47.898550987 CET	18443	49967	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:47.898611069 CET	49967	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:48.006011009 CET	49968	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:48.010807991 CET	18443	49968	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:48.012059927 CET	49968	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:48.012322903 CET	49968	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:48.017096996 CET	18443	49968	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:50.080668926 CET	18443	49968	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:50.080727100 CET	49968	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:50.080944061 CET	49968	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:50.081386089 CET	49984	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:50.085724115 CET	18443	49968	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:50.086193085 CET	18443	49984	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:50.086271048 CET	49984	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:50.087207079 CET	49984	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:50.092036963 CET	18443	49984	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:52.174536943 CET	18443	49984	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:52.174695969 CET	49984	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.174786091 CET	49984	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.175198078 CET	50000	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.179836988 CET	18443	49984	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:52.180265903 CET	18443	50000	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:52.180330038 CET	50000	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.180457115 CET	50000	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.185513973 CET	18443	50000	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:52.185563087 CET	50000	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.287585020 CET	50001	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.292678118 CET	18443	50001	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:52.292809963 CET	50001	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.293170929 CET	50001	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:52.297914982 CET	18443	50001	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:54.343029022 CET	18443	50001	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:54.343087912 CET	50001	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:54.343173027 CET	50001	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:54.343594074 CET	50015	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:54.347898006 CET	18443	50001	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:54.348402023 CET	18443	50015	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:54.348488092 CET	50015	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:54.348660946 CET	50015	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:54.353442907 CET	18443	50015	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:56.405559063 CET	18443	50015	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:56.405668974 CET	50015	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.405755997 CET	50015	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.406224966 CET	50018	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.410588026 CET	18443	50015	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:56.411143064 CET	18443	50018	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:56.411202908 CET	50018	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.411268950 CET	50018	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.416450977 CET	18443	50018	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:56.416543007 CET	50018	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.522902012 CET	50019	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.527785063 CET	18443	50019	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:56.527867079 CET	50019	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.528172016 CET	50019	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:56.532916069 CET	18443	50019	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:58.594022989 CET	18443	50019	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:58.594089031 CET	50019	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:58.594290018 CET	50019	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:58.594610929 CET	50021	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:58.599040031 CET	18443	50019	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:58.599370003 CET	18443	50021	111.119.200.175	192.168.2.6
Jan 8, 2025 11:06:58.599436045 CET	50021	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:58.599764109 CET	50021	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:06:58.604528904 CET	18443	50021	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:00.672632933 CET	18443	50021	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:00.672920942 CET	50021	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.673063993 CET	50021	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.673564911 CET	50022	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.677885056 CET	18443	50021	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:00.678378105 CET	18443	50022	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:00.678456068 CET	50022	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.678571939 CET	50022	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.683459997 CET	18443	50022	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:00.684052944 CET	50022	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.787770033 CET	50023	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.792730093 CET	18443	50023	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:00.792797089 CET	50023	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.793093920 CET	50023	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:00.797866106 CET	18443	50023	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:02.844000101 CET	18443	50023	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:02.844225883 CET	50023	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:02.845545053 CET	50023	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:02.846044064 CET	50024	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:02.850346088 CET	18443	50023	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:02.850915909 CET	18443	50024	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:02.850989103 CET	50024	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:02.865696907 CET	50024	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:02.870512962 CET	18443	50024	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:04.902734041 CET	18443	50024	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:04.908088923 CET	50024	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:04.908154011 CET	50024	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:04.908613920 CET	50025	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:04.912935019 CET	18443	50024	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:04.913502932 CET	18443	50025	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:04.913609982 CET	50025	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:04.913712978 CET	50025	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:04.918745995 CET	18443	50025	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:04.922167063 CET	50025	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:05.021886110 CET	50026	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:05.026726007 CET	18443	50026	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:05.026823997 CET	50026	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:05.027173996 CET	50026	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:05.031974077 CET	18443	50026	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:07.094938993 CET	18443	50026	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:07.095041037 CET	50026	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:07.095118999 CET	50026	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:07.095623970 CET	50028	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:07.099895954 CET	18443	50026	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:07.100419044 CET	18443	50028	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:07.100490093 CET	50028	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:07.100725889 CET	50028	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:07.105500937 CET	18443	50028	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:09.155616999 CET	18443	50028	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:09.155690908 CET	50028	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.155775070 CET	50028	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.156227112 CET	50029	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.160537958 CET	18443	50028	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:09.161067963 CET	18443	50029	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:09.161128998 CET	50029	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.161206007 CET	50029	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.166163921 CET	18443	50029	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:09.166225910 CET	50029	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.273065090 CET	50030	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.277899981 CET	18443	50030	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:09.277992010 CET	50030	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.278239965 CET	50030	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:09.282991886 CET	18443	50030	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:11.348572969 CET	18443	50030	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:11.348645926 CET	50030	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:11.348721027 CET	50030	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:11.349206924 CET	50031	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:11.353521109 CET	18443	50030	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:11.354057074 CET	18443	50031	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:11.354131937 CET	50031	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:11.354418993 CET	50031	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:11.359204054 CET	18443	50031	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.416903019 CET	18443	50031	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.419110060 CET	50031	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.419178009 CET	50031	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.419672012 CET	50032	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.423933983 CET	18443	50031	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.424546003 CET	18443	50032	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.424628019 CET	50032	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.424761057 CET	50032	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.429646015 CET	18443	50032	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.430418968 CET	18443	50032	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.430485010 CET	50032	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.537421942 CET	50033	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.542324066 CET	18443	50033	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:13.542401075 CET	50033	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.542673111 CET	50033	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:13.547485113 CET	18443	50033	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:15.611366987 CET	18443	50033	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:15.611478090 CET	50033	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:15.611555099 CET	50033	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:15.612067938 CET	50034	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:15.616363049 CET	18443	50033	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:15.616928101 CET	18443	50034	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:15.616991043 CET	50034	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:15.617319107 CET	50034	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:15.622112036 CET	18443	50034	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:17.670703888 CET	18443	50034	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:17.670900106 CET	50034	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.670900106 CET	50034	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.671382904 CET	50035	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.675761938 CET	18443	50034	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:17.676199913 CET	18443	50035	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:17.676265001 CET	50035	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.676331997 CET	50035	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.681351900 CET	18443	50035	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:17.681404114 CET	50035	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.787421942 CET	50036	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.792326927 CET	18443	50036	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:17.792459011 CET	50036	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.792917013 CET	50036	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:17.797693014 CET	18443	50036	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:19.843025923 CET	18443	50036	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:19.843146086 CET	50036	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:19.843410015 CET	50036	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:19.843781948 CET	50037	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:19.848143101 CET	18443	50036	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:19.848599911 CET	18443	50037	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:19.848671913 CET	50037	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:19.848999023 CET	50037	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:19.853733063 CET	18443	50037	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:21.887517929 CET	18443	50037	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:21.887664080 CET	50037	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:21.887804031 CET	50037	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:21.888351917 CET	50038	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:21.892561913 CET	18443	50037	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:21.893157959 CET	18443	50038	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:21.893229008 CET	50038	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:21.893290997 CET	50038	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:21.898288012 CET	18443	50038	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:21.898345947 CET	50038	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:22.007720947 CET	50039	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:22.012626886 CET	18443	50039	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:22.012703896 CET	50039	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:22.012940884 CET	50039	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:22.017745018 CET	18443	50039	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:24.079025030 CET	18443	50039	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:24.079138994 CET	50039	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:24.079251051 CET	50039	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:24.079752922 CET	50041	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:24.084012985 CET	18443	50039	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:24.084638119 CET	18443	50041	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:24.084711075 CET	50041	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:24.084939957 CET	50041	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:24.089720964 CET	18443	50041	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:26.139609098 CET	18443	50041	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:26.139815092 CET	50041	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.139815092 CET	50041	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.140242100 CET	50042	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.144685030 CET	18443	50041	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:26.145041943 CET	18443	50042	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:26.145104885 CET	50042	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.145176888 CET	50042	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.153609037 CET	18443	50042	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:26.153666019 CET	50042	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.256386042 CET	50043	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.261205912 CET	18443	50043	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:26.261354923 CET	50043	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.261676073 CET	50043	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:26.266437054 CET	18443	50043	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:28.314347029 CET	18443	50043	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:28.314429998 CET	50043	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:28.314502001 CET	50043	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:28.314950943 CET	50044	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:28.319212914 CET	18443	50043	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:28.319727898 CET	18443	50044	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:28.319813967 CET	50044	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:28.320101976 CET	50044	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:28.324805975 CET	18443	50044	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:30.375570059 CET	18443	50044	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:30.375691891 CET	50044	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.375768900 CET	50044	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.376267910 CET	50045	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.380677938 CET	18443	50044	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:30.381093025 CET	18443	50045	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:30.381151915 CET	50045	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.395741940 CET	50045	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.400696993 CET	18443	50045	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:30.400810957 CET	50045	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.506572008 CET	50046	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.511473894 CET	18443	50046	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:30.511549950 CET	50046	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.511842966 CET	50046	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:30.516639948 CET	18443	50046	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:32.564326048 CET	18443	50046	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:32.564423084 CET	50046	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:32.564498901 CET	50046	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:32.564974070 CET	50048	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:32.569293022 CET	18443	50046	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:32.569809914 CET	18443	50048	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:32.569889069 CET	50048	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:32.570107937 CET	50048	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:32.574873924 CET	18443	50048	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:34.624443054 CET	18443	50048	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:34.624562979 CET	50048	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.624687910 CET	50048	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.625191927 CET	50049	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.640125990 CET	18443	50048	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:34.640139103 CET	18443	50049	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:34.640225887 CET	50049	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.640328884 CET	50049	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.652666092 CET	18443	50049	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:34.652775049 CET	50049	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.757436991 CET	50050	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.762331009 CET	18443	50050	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:34.762398958 CET	50050	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.762834072 CET	50050	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:34.767597914 CET	18443	50050	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:36.811937094 CET	18443	50050	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:36.812047005 CET	50050	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:36.812139034 CET	50050	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:36.812613010 CET	50051	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:36.816873074 CET	18443	50050	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:36.817424059 CET	18443	50051	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:36.817492008 CET	50051	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:36.817703962 CET	50051	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:36.822484016 CET	18443	50051	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:38.878916979 CET	18443	50051	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:38.879018068 CET	50051	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.879086971 CET	50051	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.879657984 CET	50052	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.883816957 CET	18443	50051	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:38.884459019 CET	18443	50052	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:38.884525061 CET	50052	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.884598017 CET	50052	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.889434099 CET	18443	50052	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:38.889488935 CET	50052	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.990767956 CET	50053	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.995660067 CET	18443	50053	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:38.995763063 CET	50053	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:38.996037006 CET	50053	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:39.001058102 CET	18443	50053	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:41.067466974 CET	18443	50053	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:41.067673922 CET	50053	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:41.068221092 CET	50053	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:41.068222046 CET	50054	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:41.075287104 CET	18443	50053	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:41.075300932 CET	18443	50054	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:41.075376987 CET	50054	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:41.075615883 CET	50054	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:41.083880901 CET	18443	50054	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:43.123900890 CET	18443	50054	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:43.124310017 CET	50054	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.124403954 CET	50054	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.124919891 CET	50055	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.129148006 CET	18443	50054	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:43.129759073 CET	18443	50055	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:43.129966021 CET	50055	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.130093098 CET	50055	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.135019064 CET	18443	50055	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:43.136281967 CET	50055	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.240852118 CET	50056	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.245779991 CET	18443	50056	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:43.245867014 CET	50056	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.246140957 CET	50056	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:43.250869989 CET	18443	50056	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:45.296962023 CET	18443	50056	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:45.297024012 CET	50056	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:45.297091961 CET	50056	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:45.297560930 CET	50057	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:45.301882982 CET	18443	50056	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:45.302439928 CET	18443	50057	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:45.302505970 CET	50057	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:45.302846909 CET	50057	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:45.307634115 CET	18443	50057	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:47.359940052 CET	18443	50057	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:47.360002041 CET	50057	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.360081911 CET	50057	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.360570908 CET	50058	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.364862919 CET	18443	50057	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:47.365391970 CET	18443	50058	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:47.365452051 CET	50058	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.365559101 CET	50058	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.370420933 CET	18443	50058	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:47.370462894 CET	50058	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.481825113 CET	50059	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.486635923 CET	18443	50059	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:47.486709118 CET	50059	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.487740040 CET	50059	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:47.492486000 CET	18443	50059	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:49.569233894 CET	18443	50059	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:49.569308043 CET	50059	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:49.569387913 CET	50059	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:49.569873095 CET	50060	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:49.574105978 CET	18443	50059	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:49.574667931 CET	18443	50060	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:49.574737072 CET	50060	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:49.574942112 CET	50060	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:49.579682112 CET	18443	50060	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:51.627310991 CET	18443	50060	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:51.627425909 CET	50060	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.627505064 CET	50060	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.628027916 CET	50061	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.632265091 CET	18443	50060	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:51.632935047 CET	18443	50061	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:51.633004904 CET	50061	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.633121014 CET	50061	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.638076067 CET	18443	50061	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:51.638148069 CET	50061	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.740953922 CET	50062	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.745778084 CET	18443	50062	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:51.745863914 CET	50062	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.746148109 CET	50062	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:51.750891924 CET	18443	50062	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:53.798022032 CET	18443	50062	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:53.798141003 CET	50062	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:53.798213005 CET	50062	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:53.798693895 CET	50063	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:53.802964926 CET	18443	50062	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:53.803541899 CET	18443	50063	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:53.803606033 CET	50063	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:53.803817987 CET	50063	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:53.808579922 CET	18443	50063	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:55.858005047 CET	18443	50063	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:55.858134985 CET	50063	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.858249903 CET	50063	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.858895063 CET	50064	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.863095045 CET	18443	50063	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:55.863770962 CET	18443	50064	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:55.863859892 CET	50064	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.864022017 CET	50064	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.868973970 CET	18443	50064	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:55.869071960 CET	50064	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.975377083 CET	50065	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.980237961 CET	18443	50065	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:55.980371952 CET	50065	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.980792999 CET	50065	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:55.985542059 CET	18443	50065	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:58.029908895 CET	18443	50065	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:58.030076027 CET	50065	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:58.030286074 CET	50065	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:58.031507015 CET	50066	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:58.035021067 CET	18443	50065	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:58.036308050 CET	18443	50066	111.119.200.175	192.168.2.6
Jan 8, 2025 11:07:58.036420107 CET	50066	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:58.037079096 CET	50066	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:07:58.041807890 CET	18443	50066	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:00.101104021 CET	18443	50066	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:00.101222992 CET	50066	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.121656895 CET	50066	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.122868061 CET	50068	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.126506090 CET	18443	50066	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:00.127669096 CET	18443	50068	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:00.127736092 CET	50068	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.127932072 CET	50068	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.132762909 CET	18443	50068	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:00.132810116 CET	50068	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.333074093 CET	50069	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.338010073 CET	18443	50069	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:00.338073969 CET	50069	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.364023924 CET	50069	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:00.368860006 CET	18443	50069	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:02.426177979 CET	18443	50069	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:02.426285028 CET	50069	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:02.426382065 CET	50069	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:02.426912069 CET	50070	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:02.431212902 CET	18443	50069	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:02.431735039 CET	18443	50070	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:02.431802988 CET	50070	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:02.432092905 CET	50070	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:02.436817884 CET	18443	50070	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.499265909 CET	18443	50070	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.499365091 CET	50070	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.499455929 CET	50070	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.499999046 CET	50071	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.504173040 CET	18443	50070	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.504748106 CET	18443	50071	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.504822016 CET	50071	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.504895926 CET	50071	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.510070086 CET	18443	50071	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.510081053 CET	18443	50071	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.510138035 CET	50071	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.616050959 CET	50072	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.621232033 CET	18443	50072	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:04.621346951 CET	50072	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.621702909 CET	50072	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:04.626461983 CET	18443	50072	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:06.670515060 CET	18443	50072	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:06.670630932 CET	50072	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:06.670722008 CET	50072	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:06.671221972 CET	50073	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:06.675508976 CET	18443	50072	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:06.676043034 CET	18443	50073	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:06.676110029 CET	50073	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:06.676307917 CET	50073	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:06.681124926 CET	18443	50073	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:08.737998009 CET	18443	50073	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:08.738145113 CET	50073	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.738235950 CET	50073	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.738723993 CET	50074	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.743211985 CET	18443	50073	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:08.743505001 CET	18443	50074	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:08.743571043 CET	50074	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.743640900 CET	50074	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.748744011 CET	18443	50074	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:08.748801947 CET	50074	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.850404024 CET	50075	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.855288029 CET	18443	50075	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:08.855390072 CET	50075	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.855700016 CET	50075	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:08.860539913 CET	18443	50075	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:10.906843901 CET	18443	50075	111.119.200.175	192.168.2.6
Jan 8, 2025 11:08:10.906924963 CET	50075	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:10.907020092 CET	50075	18443	192.168.2.6	111.119.200.175
Jan 8, 2025 11:08:10.911787033 CET	18443	50075	111.119.200.175	192.168.2.6

Target ID:	0
Start time:	05:06:03
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\c_shlellcode.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\c_shlellcode.exe"
Imagebase:	0x7ff7653a0000
File size:	5'593'088 bytes
MD5 hash:	3E96C0115AEAC2B89D926F326079FDC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.3386553887.000001BCF9B60000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.3386483169.000001BCF9A10000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.3386186288.000001BCF9910000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c_shlellcode.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: c_shlellcode.exePID: 7116, Parent PID: 4004

General

Windows Analysis Report
c_shlellcode.exe