Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
05-01-2022 14:42
Static task
static1
Behavioral task
behavioral1
Sample
4f8830dd18dd4c4414a876206b03d02b244a9b62caeb9f7642bd78affa438130.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4f8830dd18dd4c4414a876206b03d02b244a9b62caeb9f7642bd78affa438130.exe
Resource
win10-en-20211208
General
-
Target
4f8830dd18dd4c4414a876206b03d02b244a9b62caeb9f7642bd78affa438130.exe
-
Size
2.0MB
-
MD5
9e7c0c655b630e782d3843d5f9a8e001
-
SHA1
e3d8f1dc91ca72246f1ca8ca1b5fd9fc362636d6
-
SHA256
4f8830dd18dd4c4414a876206b03d02b244a9b62caeb9f7642bd78affa438130
-
SHA512
8b45a3040b0b0c7a826069a56acbe22de12b552882416938796c912aad7ffc49795ffc68b42f4cda292f18a3ff4f35af36c823bd27798629ec893bbfd6d840a8
Malware Config
Extracted
cobaltstrike
http://47.93.63.179:5812/TOmM
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2920-115-0x0000019DA9F90000-0x0000019DA9F91000-memory.dmpFilesize
4KB