Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-12-2020 04:49
General
-
Target
1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9.dll
-
Size
688KB
-
MD5
a91bf61cc18705be2288a0f6f125068f
-
SHA1
d535de08875cef1c49bfa2532281fa1254a8cb93
-
SHA256
1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9
-
SHA512
a7c9a05f0d1a2b868ec608ac4dc116fd79fb36728bc4f371e9eab3cadb869b6ac53dd97cbf64a7d18ce237430cdd08f64ebab7b68ac39f3bf486d772be3a96dc
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
Attributes
-
access_type
0
-
beacon_type
0
-
create_remote_thread
0
-
day
0
-
dns_idle
0
-
dns_sleep
0
- host
- http_header1
- http_header2
- http_method1
- http_method2
- injection_process
-
jitter
0
-
maxdns
0
-
month
0
- pipe_name
-
polling_time
0
-
port_number
0
- proxy_password
- proxy_server
- proxy_username
- sc_process32
- sc_process64
- state_machine
-
unknown1
0
- unknown2
-
unknown3
0
-
unknown4
0
-
unknown5
0
- uri
- user_agent
-
year
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1cf5710e500a423b84b51fa3afdd923fe0a8255c5817d3238175623e2ebbfad9.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4772-2-0x00007FFBE4620000-0x00007FFBE500C000-memory.dmpFilesize
9.9MB
-
memory/4772-3-0x00000137EB7D0000-0x00000137EB7D1000-memory.dmpFilesize
4KB
-
memory/4772-5-0x00000137E9650000-0x00000137E9690000-memory.dmpFilesize
256KB
-
memory/4772-6-0x00000137EAFB0000-0x00000137EB021000-memory.dmpFilesize
452KB