Analysis
-
max time kernel
1797s -
max time network
1800s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
testing.exe
Resource
win10v20210410
General
-
Target
testing.exe
-
Size
72KB
-
MD5
b5d2585a9d50e788a37d6700ed8133cf
-
SHA1
c6617ceea2106f76078c195a4a86cb7e6fc31507
-
SHA256
0d1fbb35e0a41955bb9e49e3e765be71121a661ba0b374c5e352be5a87639240
-
SHA512
70e05be3e01dc7d779f9a8313efc256af5c0819acc1d3b7d0247767ed85fa4f40aa641bf1ebc366310557e88bd9bc25144c5f9a2c8180f58ebc91a44c1d5b6e5
Malware Config
Extracted
metasploit
windows/reverse_tcp
13.59.15.185:16297
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-114-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/772-115-0x0000000000460000-0x000000000048B000-memory.dmpFilesize
172KB
-
memory/772-116-0x00000000008A0000-0x00000000008D1000-memory.dmpFilesize
196KB
-
memory/772-117-0x0000000002620000-0x000000000267F000-memory.dmpFilesize
380KB
-
memory/772-118-0x0000000002680000-0x00000000026A3000-memory.dmpFilesize
140KB