Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2022, 15:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    426KB

  • MD5

    62a4aa621e034dbdaaf2bef8f5a4aef0

  • SHA1

    0dcaf764946746594f14e4c1f75ec7b47f8a1257

  • SHA256

    b239b5d05aba2f98cbc955c1b88884495db53f5b3a3381b94db1aa76e3ed67a1

  • SHA512

    41ce96558693f955e09e1714feae01e3dd0bc0b7d2df6226b0136feb7e95049118a8e67d7fb3a8636b06655f385df18489fdf09db2b44720ccb049d568d23e72

  • SSDEEP

    12288:nOYO68aew0lMKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKK7:NOb2KTKK4KKDyK5FZ1EEEEmEEE1EEEEE

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://114.116.101.84:85/bootstrap.min.js

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
      PID:1428

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1428-132-0x0000005EAFFFE000-0x0000005EB0000000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1428-133-0x00000200FC610000-0x00000200FCA10000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1428-134-0x00000200FABD0000-0x00000200FAC22000-memory.dmp

      Filesize

      328KB

      Download

    • memory/1428-135-0x00000200FABD0000-0x00000200FAC22000-memory.dmp

      Filesize

      328KB

      Download