Analysis Overview
SHA256
77f74e571dfde172d085fed2ad40b95c5e2e46a93ebfa127a03761ca31a7ac3f
Threat Level: Known bad
The file 77f74e571dfde172d085fed2ad40b95c5e2e46a93ebfa127a03761ca31a7ac3f was found to be: Known bad.
Malicious Activity Summary
Cobaltstrike
Unsigned PE
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-10-23 14:32
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-23 14:32
Reported
2023-10-23 14:35
Platform
win7-20231020-en
Max time kernel
141s
Max time network
143s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\77f74e571dfde172d085fed2ad40b95c5e2e46a93ebfa127a03761ca31a7ac3f.exe
"C:\Users\Admin\AppData\Local\Temp\77f74e571dfde172d085fed2ad40b95c5e2e46a93ebfa127a03761ca31a7ac3f.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 192.236.146.5:80 | tcp | |
| NL | 192.236.146.5:80 | tcp | |
| NL | 192.236.146.5:80 | tcp |
Files
memory/1732-1-0x0000000000400000-0x000000000048B000-memory.dmp
memory/1732-0-0x00000000001C0000-0x00000000001C7000-memory.dmp
memory/1732-2-0x0000000000400000-0x000000000048B000-memory.dmp
memory/1732-3-0x0000000001CA0000-0x0000000001CD3000-memory.dmp
memory/1732-4-0x0000000001CE0000-0x0000000001D1D000-memory.dmp
memory/1732-5-0x0000000000400000-0x000000000048B000-memory.dmp
memory/1732-6-0x0000000075300000-0x000000007534E000-memory.dmp
memory/1732-7-0x00000000001C0000-0x00000000001C7000-memory.dmp
memory/1732-8-0x0000000001CE0000-0x0000000001D1D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-23 14:32
Reported
2023-10-23 14:35
Platform
win10v2004-20231023-en
Max time kernel
141s
Max time network
144s
Command Line
Signatures
Cobaltstrike
Processes
C:\Users\Admin\AppData\Local\Temp\77f74e571dfde172d085fed2ad40b95c5e2e46a93ebfa127a03761ca31a7ac3f.exe
"C:\Users\Admin\AppData\Local\Temp\77f74e571dfde172d085fed2ad40b95c5e2e46a93ebfa127a03761ca31a7ac3f.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 192.236.146.5:80 | tcp | |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.179.89.13.in-addr.arpa | udp |
| NL | 192.236.146.5:80 | tcp |
Files
memory/4708-1-0x0000000000400000-0x000000000048B000-memory.dmp
memory/4708-0-0x0000000000A80000-0x0000000000A87000-memory.dmp
memory/4708-2-0x0000000000400000-0x000000000048B000-memory.dmp
memory/4708-3-0x00000000025D0000-0x0000000002603000-memory.dmp
memory/4708-4-0x0000000002610000-0x000000000264D000-memory.dmp
memory/4708-5-0x0000000000400000-0x000000000048B000-memory.dmp
memory/4708-6-0x0000000074730000-0x000000007479A000-memory.dmp
memory/4708-7-0x0000000000A80000-0x0000000000A87000-memory.dmp
memory/4708-8-0x0000000002610000-0x000000000264D000-memory.dmp