Analysis Overview
SHA256
233579e5fcb25035ac0f0fdd2264931c7918d936e642c1f30f29ef9cb7e74514
Threat Level: Known bad
The file 233579e5fcb25035ac0f0fdd2264931c7918d936e642c1f30f29ef9cb7e74514 was found to be: Known bad.
Malicious Activity Summary
Cobaltstrike
Cobaltstrike family
Unsigned PE
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-08-08 07:40
Signatures
Cobaltstrike family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-08-08 07:40
Reported
2023-08-08 07:42
Platform
win10v2004-20230703-en
Max time kernel
143s
Max time network
149s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\233579e5fcb25035ac0f0fdd2264931c7918d936e642c1f30f29ef9cb7e74514.exe
"C:\Users\Admin\AppData\Local\Temp\233579e5fcb25035ac0f0fdd2264931c7918d936e642c1f30f29ef9cb7e74514.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pypi.python.org | udp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| US | 8.8.8.8:53 | 223.36.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| US | 8.8.8.8:53 | 59.189.79.40.in-addr.arpa | udp |
Files
memory/2924-133-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2924-134-0x0000000000670000-0x00000000006AD000-memory.dmp
memory/2924-135-0x0000000000670000-0x00000000006AD000-memory.dmp
memory/2924-136-0x0000000000400000-0x000000000043D000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2023-08-08 07:40
Reported
2023-08-08 07:42
Platform
win7-20230712-en
Max time kernel
123s
Max time network
126s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\233579e5fcb25035ac0f0fdd2264931c7918d936e642c1f30f29ef9cb7e74514.exe
"C:\Users\Admin\AppData\Local\Temp\233579e5fcb25035ac0f0fdd2264931c7918d936e642c1f30f29ef9cb7e74514.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | pypi.python.org | udp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
| NL | 151.101.36.223:443 | pypi.python.org | tcp |
Files
memory/1856-54-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1856-55-0x0000000000220000-0x000000000025D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Cab7CFF.tmp
| MD5 | 3ac860860707baaf32469fa7cc7c0192 |
| SHA1 | c33c2acdaba0e6fa41fd2f00f186804722477639 |
| SHA256 | d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904 |
| SHA512 | d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c |
C:\Users\Admin\AppData\Local\Temp\Tar7D8E.tmp
| MD5 | 4ff65ad929cd9a367680e0e5b1c08166 |
| SHA1 | c0af0d4396bd1f15c45f39d3b849ba444233b3a2 |
| SHA256 | c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6 |
| SHA512 | f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27 |
memory/1856-110-0x0000000000220000-0x000000000025D000-memory.dmp
memory/1856-111-0x0000000000400000-0x000000000043D000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
| MD5 | 6bdb8644400e578625cd64a2641e3b25 |
| SHA1 | 86862d678e672766366a602a7ea7d3204553c16f |
| SHA256 | 393133190b643e8e954da586e0f11d8f125c80b7ae23300d859b451faededca1 |
| SHA512 | 1bce18f0f8a47ba9397c1c16f3a35fb7f502ec42154080bde7cdec75a6c3318887c5898770233e6ce7a6c2b8c2115cba6992018274f390bb00e17071368ec06c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
| MD5 | c5dfb849ca051355ee2dba1ac33eb028 |
| SHA1 | d69b561148f01c77c54578c10926df5b856976ad |
| SHA256 | cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b |
| SHA512 | 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da |