Analysis
-
max time kernel
118s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 14:33
Static task
static1
Behavioral task
behavioral1
Sample
a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d.exe
Resource
win10v2004-20230221-en
General
-
Target
a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d.exe
-
Size
138KB
-
MD5
8d6b5daa3dbd2cecf334e1daef15674f
-
SHA1
79f660ffe33e3a158202eb90800b88e948db1467
-
SHA256
a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d
-
SHA512
46446cccf947380762b521129a4b13d091c12f54a8767f878895131e97e8e57082648d539d450a5f60f7b05f637ddeda577bdc1403e82bc8e4a52bbcbbf34755
-
SSDEEP
3072:Kuk09Pu3p7Rmun0nwJ6Pas57lUJnzhNA+wnXjc:hkNdRmu0nwsyYu8+wzc
Malware Config
Extracted
cobaltstrike
http://tibenorote.com:443/static-directory/fr.gif
-
user_agent
Host: google.co.in Connection: close User-Agent: Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4172 1904 WerFault.exe a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d.exe"C:\Users\Admin\AppData\Local\Temp\a27734578daa0ece490f3df8fef37d7218bd91e0d786021c6fa51ebfb40d782d.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1904 -s 11482⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 1904 -ip 19041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1904-133-0x0000015102EF0000-0x0000015102EF7000-memory.dmpFilesize
28KB