Analysis Overview
SHA256
fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843
Threat Level: Known bad
The file fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843 was found to be: Known bad.
Malicious Activity Summary
Cobaltstrike
CryptOne packer
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-06-26 04:15
Signatures
CryptOne packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-06-26 04:15
Reported
2023-06-26 04:17
Platform
win7-20230621-en
Max time kernel
140s
Max time network
34s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843.exe
"C:\Users\Admin\AppData\Local\Temp\fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843.exe"
Network
Files
memory/108-54-0x0000000000220000-0x0000000000267000-memory.dmp
memory/108-55-0x0000000000400000-0x0000000000458000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-06-26 04:15
Reported
2023-06-26 04:17
Platform
win10v2004-20230621-en
Max time kernel
141s
Max time network
133s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843.exe
"C:\Users\Admin\AppData\Local\Temp\fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| DE | 37.120.222.56:80 | tcp | |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 52.168.117.169:443 | tcp | |
| US | 192.229.221.95:80 | tcp | |
| US | 8.8.8.8:53 | 2.77.109.52.in-addr.arpa | udp |
| DE | 37.120.222.56:80 | tcp | |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
Files
memory/3676-133-0x0000000000740000-0x0000000000787000-memory.dmp
memory/3676-134-0x0000000002390000-0x00000000023C3000-memory.dmp
memory/3676-135-0x0000000002640000-0x000000000267D000-memory.dmp
memory/3676-136-0x0000000000400000-0x0000000000458000-memory.dmp