Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-01-2021 13:10
General
-
Target
51abcecacd2fdd25bb8ef3a64b02aaa940b6d08ea2f7f48d5d6dc13d6912a561.exe
-
Size
663KB
-
MD5
f3acf00f641c4f24892e6864aa59b7c3
-
SHA1
7323a3c2f0b4c85099b275f78fb6f4d4f586c148
-
SHA256
51abcecacd2fdd25bb8ef3a64b02aaa940b6d08ea2f7f48d5d6dc13d6912a561
-
SHA512
9648c2cb6007c7af4b1c953e8e80f1f6a173208a55bd3326d49fef64695832837575e7300bf040cac20f8d365a6ae85c4f213014f399ef24284348f16653036e
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
Attributes
-
access_type
0
-
beacon_type
0
-
create_remote_thread
0
-
day
0
-
dns_idle
0
-
dns_sleep
0
- host
- http_header1
- http_header2
- http_method1
- http_method2
- injection_process
-
jitter
0
-
maxdns
0
-
month
0
- pipe_name
-
polling_time
0
-
port_number
0
- proxy_password
- proxy_server
- proxy_username
- sc_process32
- sc_process64
- state_machine
-
unknown1
0
- unknown2
-
unknown3
0
-
unknown4
0
-
unknown5
0
- uri
- user_agent
-
year
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
-
C:\Users\Admin\AppData\Local\Temp\51abcecacd2fdd25bb8ef3a64b02aaa940b6d08ea2f7f48d5d6dc13d6912a561.exe"C:\Users\Admin\AppData\Local\Temp\51abcecacd2fdd25bb8ef3a64b02aaa940b6d08ea2f7f48d5d6dc13d6912a561.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-5-0x000007FEF5E90000-0x000007FEF610A000-memory.dmpFilesize
2.5MB
-
memory/1748-2-0x00000000002D0000-0x0000000000326000-memory.dmpFilesize
344KB
-
memory/1748-4-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1748-3-0x0000000001E20000-0x0000000001E76000-memory.dmpFilesize
344KB
-
memory/1748-6-0x000007FEFB811000-0x000007FEFB813000-memory.dmpFilesize
8KB
-
memory/1748-7-0x0000000003BC0000-0x0000000003FC0000-memory.dmpFilesize
4.0MB
-
memory/1748-8-0x00000000027F0000-0x000000000283D000-memory.dmpFilesize
308KB