Analysis Overview
SHA256
04f4b3e70995a4703c165fa90346615dafa66f22cf54795ffd58d35093249a63
Threat Level: Known bad
The file 04f4b3e70995a4703c165fa90346615dafa66f22cf54795ffd58d35093249a63 was found to be: Known bad.
Malicious Activity Summary
Cobaltstrike
Unsigned PE
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-09-16 14:34
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-09-16 14:34
Reported
2023-09-16 14:37
Platform
win7-20230831-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\04f4b3e70995a4703c165fa90346615dafa66f22cf54795ffd58d35093249a63.exe
"C:\Users\Admin\AppData\Local\Temp\04f4b3e70995a4703c165fa90346615dafa66f22cf54795ffd58d35093249a63.exe"
Network
| Country | Destination | Domain | Proto |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | tcp |
Files
memory/2188-0-0x00000000005E0000-0x0000000000660000-memory.dmp
memory/2188-1-0x000000013FF60000-0x000000013FFEA000-memory.dmp
memory/2188-2-0x0000000003EE0000-0x00000000042E0000-memory.dmp
memory/2188-3-0x000007FEF7AF0000-0x000007FEF7B9C000-memory.dmp
memory/2188-4-0x000000013FF60000-0x000000013FFEA000-memory.dmp
memory/2188-5-0x000007FEF7AF0000-0x000007FEF7B9C000-memory.dmp
memory/2188-19-0x000007FEF7AF0000-0x000007FEF7B9C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-09-16 14:34
Reported
2023-09-16 14:37
Platform
win10v2004-20230915-en
Max time kernel
146s
Max time network
155s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\04f4b3e70995a4703c165fa90346615dafa66f22cf54795ffd58d35093249a63.exe
"C:\Users\Admin\AppData\Local\Temp\04f4b3e70995a4703c165fa90346615dafa66f22cf54795ffd58d35093249a63.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| US | 8.8.8.8:53 | 254.210.247.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.194.96.119.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
| US | 8.8.8.8:53 | 208.143.182.52.in-addr.arpa | udp |
| CN | 119.96.194.181:4455 | outlook.live.com | tcp |
Files
memory/1396-0-0x000002573DFC0000-0x000002573DFD0000-memory.dmp
memory/1396-1-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-2-0x000002573F930000-0x000002573FD30000-memory.dmp
memory/1396-3-0x00007FF7AE0B0000-0x00007FF7AE13A000-memory.dmp
memory/1396-4-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-5-0x000002573DFC0000-0x000002573DFD0000-memory.dmp
memory/1396-6-0x000002573F930000-0x000002573FD30000-memory.dmp
memory/1396-8-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-10-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-12-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-14-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-18-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-20-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-22-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-24-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-26-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp
memory/1396-29-0x00007FF7AE0B0000-0x00007FF7AE13A000-memory.dmp
memory/1396-32-0x00007FF8CE120000-0x00007FF8CE1AD000-memory.dmp