Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 14:34
Static task
static1
Behavioral task
behavioral1
Sample
ae73d9340a495f4dcae63f042a0bf781.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ae73d9340a495f4dcae63f042a0bf781.exe
Resource
win10v2004-20230220-en
General
-
Target
ae73d9340a495f4dcae63f042a0bf781.exe
-
Size
2.0MB
-
MD5
ae73d9340a495f4dcae63f042a0bf781
-
SHA1
0ef080138ec43b945210ffa039888b5f3ee7c7df
-
SHA256
57a73ff0c065ccf8cd111195c53e8174f01de06cde2db1a6afff5ba05b07e743
-
SHA512
d350b52f8d628cd3ec91438c98e7d3873c064c77c7b3ac61e5a5d7b57899c455b48960b40d73c8459009c069a84cc8c84537716f66b7e03607327ade2b2bcc52
-
SSDEEP
49152:ydM8vBhkWxEDzA79QBHsxpqxBzUzgG69FInxkA9:ydtDkbMB2Hsxp4zULjT
Malware Config
Extracted
cobaltstrike
http://116.204.74.236:80/dfOD
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; .NET CLR 2.0.50727)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
ae73d9340a495f4dcae63f042a0bf781.exepid process 1200 ae73d9340a495f4dcae63f042a0bf781.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-54-0x00000000008D0000-0x0000000000AB7000-memory.dmpFilesize
1.9MB
-
memory/1200-55-0x0000000002D90000-0x0000000003264000-memory.dmpFilesize
4.8MB
-
memory/1200-57-0x00000000008D0000-0x0000000000AB7000-memory.dmpFilesize
1.9MB
-
memory/1200-58-0x0000000002D90000-0x0000000003264000-memory.dmpFilesize
4.8MB
-
memory/1200-59-0x0000000002D90000-0x0000000003264000-memory.dmpFilesize
4.8MB
-
memory/1200-60-0x0000000002D90000-0x0000000003264000-memory.dmpFilesize
4.8MB
-
memory/1200-64-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1200-65-0x0000000000400000-0x000000000060A000-memory.dmpFilesize
2.0MB