Analysis
-
max time kernel
144s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09-10-2023 11:38
General
-
Target
66d3588aba78c75a1cef6e2ef78658995e9bd7ac5bae3a146555e9e1552f390e.exe
-
Size
1.4MB
-
MD5
1eb04ec39c477b669e5c2a4d9cadb311
-
SHA1
7426f4221d0f2807805117e2f40b593da4744d1d
-
SHA256
66d3588aba78c75a1cef6e2ef78658995e9bd7ac5bae3a146555e9e1552f390e
-
SHA512
50c13a2be956abec07f188da7e7a2cb01b5ff67b8a8e2b31c865f28784352fcccbcaa4bd76b9af543440b14f98f1d93e2c9dd5ab2292daa238facb8914d11249
-
SSDEEP
24576:qt2DaDYipbx9vetzrTpykpqRYlGdADD7HXxydNAILXSze9p8LklA:qEDSY8af8YlcAbHXcdNRX4eQLk2
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://47.94.214.199:80/zLDS
Attributes
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66d3588aba78c75a1cef6e2ef78658995e9bd7ac5bae3a146555e9e1552f390e.exe"C:\Users\Admin\AppData\Local\Temp\66d3588aba78c75a1cef6e2ef78658995e9bd7ac5bae3a146555e9e1552f390e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB