Analysis

  • max time kernel
    29s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 05:59

General

  • Target

    89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe

  • Size

    72KB

  • MD5

    e539eff325e6589cc72c82f4d6f8b9c0

  • SHA1

    00838afcb1615a52d64a8e02785de6a16532efe5

  • SHA256

    89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8

  • SHA512

    9b0311595b7a57e8992854c2fb9ef86a1789761053d3e064b5b965bce63b346b6e9a37ea9ef4750c806f3774cebadc4aaa1f215b85451bf48d4e5ab7ac22acb2

  • SSDEEP

    1536:S+won4kYqDhPGGVXfC8xPklyHN+ul2tnvYozU:S+bFDhPGG08GbuMb

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe
    "C:\Users\Admin\AppData\Local\Temp\89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/112-55-0x0000000000250000-0x0000000000258000-memory.dmp

    Filesize

    32KB

  • memory/112-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

    Filesize

    8KB

  • memory/112-59-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/112-60-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB