Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 17:50
General
-
Target
903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84.exe
-
Size
15KB
-
MD5
c41a4cb7f0043990da075f222ecbc33d
-
SHA1
580d88e2e503322c259c93dcbd2052e5c8cae0d7
-
SHA256
903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84
-
SHA512
ee6202b44c34961dc3f14e00a4bd94fcbd36268852786440cdd530f32be40c3937a601751f580592fca8cf9ffe4ddb3ec928df5e3d53e7435d24c6ad643186aa
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://192.168.0.102:8080/p2uF
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;PTBR)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84.exe"C:\Users\Admin\AppData\Local\Temp\903dbd72c1732e86c04836468cca542a83a118b17a1767b02c2137059210df84.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
-
Filesize
8KB
-
Filesize
32KB