Analysis
-
max time kernel
135s -
max time network
188s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
30-07-2021 15:25
General
-
Target
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9.dll
-
Size
514KB
-
MD5
2abdfeb9090ff090ae9db0a5559e09c7
-
SHA1
4925d41d6db6e3f47250be8cdc21bb1548c7261a
-
SHA256
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9
-
SHA512
e11be9b4828d3fbb39bbf7dcf673fb4e5facef5ee6b9e023feb2c75bc6be7cdb52994151074dfb5008123fd533b6b6978af7b0d94231da088cee307a88293ceb
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://softzbh.com:443/jquery-3.3.2.slim.min.js
Attributes
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB