Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-12-2021 08:43
Static task
static1
Behavioral task
behavioral1
Sample
f5dd87ec40ee0c9237070798b94c9af5e041b3f48c4cf1d99dbf13e0832f13c4.bin.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f5dd87ec40ee0c9237070798b94c9af5e041b3f48c4cf1d99dbf13e0832f13c4.bin.exe
Resource
win10-en-20211208
General
-
Target
f5dd87ec40ee0c9237070798b94c9af5e041b3f48c4cf1d99dbf13e0832f13c4.bin.exe
-
Size
1.3MB
-
MD5
feedc3017aeee7e728577421ba829592
-
SHA1
fcccb305f5966d9fd12688a2ff982ef328669d3e
-
SHA256
f5dd87ec40ee0c9237070798b94c9af5e041b3f48c4cf1d99dbf13e0832f13c4
-
SHA512
b7da38720b52043022e91767522d204829ab23da88a71384e289aca9c514bd1642cd237046f294bdd3b607c874afc86f59df35affccad4e1dd360c1f4c29f7bf
Malware Config
Extracted
cobaltstrike
http://117.50.173.122:801/Rpc
-
user_agent
Host: outlook.live.com Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3160-115-0x00000217F1D80000-0x00000217F1D81000-memory.dmpFilesize
4KB