Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
05/12/2023, 17:17
General
- Target e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86.exe
- Size 4.8MB
- Sample231205-vtq3csde75
- SHA256 e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86
Malware Config
Extracted
-
cobaltstrike
-
http://192.168.1.201:443/js/jquery-3.4.1.slim.min.js
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86.exe"C:\Users\Admin\AppData\Local\Temp\e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2944-2-0x0000000140000000-0x00000001407F0000-memory.dmp
memory/2944-0-0x00007FFCE8750000-0x00007FFCE8752000-memory.dmp
memory/2944-1-0x0000000140000000-0x00000001407F0000-memory.dmp
memory/2944-5-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2944-6-0x0000000000440000-0x0000000000441000-memory.dmp
memory/2944-7-0x00000000020E0000-0x00000000022D5000-memory.dmp
memory/2944-8-0x0000000140000000-0x00000001407F0000-memory.dmp