Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
23-09-2023 16:02
General
-
Target
d6c5cbb750ab6e8d09248f28c07f694586f91cea820341fb1aa01ebea0bfa24d.exe
-
Size
2.8MB
-
MD5
d427d5b649b752c34bbb297d2262bd51
-
SHA1
d1f02089d21316573f910edfce39c5e1f24cad41
-
SHA256
d6c5cbb750ab6e8d09248f28c07f694586f91cea820341fb1aa01ebea0bfa24d
-
SHA512
439c3f824c21f869502033f890fb4f7e88685930b79fb1af1dd2ffd8e2bb3f584630926869f407e5f594c8545574faed5deb5aa6782ab31ede3ec5c06b440d58
-
SSDEEP
49152:M0X6sPA8ZQfnCwZoQVdIaGD9q5GZti6QqglNicFY2sAjmQ8+JEWZ1pv9AqvddIzg:tX6sIbvjZPIaGpq5GSnFeASQ8kVly0
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://45.152.64.178:8014/tR5b
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; BOIE9;ENUS)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c5cbb750ab6e8d09248f28c07f694586f91cea820341fb1aa01ebea0bfa24d.exe"C:\Users\Admin\AppData\Local\Temp\d6c5cbb750ab6e8d09248f28c07f694586f91cea820341fb1aa01ebea0bfa24d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4KB
-
Filesize
4.0MB
-
Filesize
4.0MB