Overview

overview

10

Static

static

7

9ab704a356...df.exe

windows7-x64

10

9ab704a356...df.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14-02-2024 04:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9ab704a3567195e5185a3ff61938cadf.exe

  • Size

    610KB

  • MD5

    9ab704a3567195e5185a3ff61938cadf

  • SHA1

    9371c3d5b0e765ce358955adc9955277afcf1ba9

  • SHA256

    b326f4a5d4f1d482d76a8eeae80f33ba972a6e8a293107dc10d73f517476af4b

  • SHA512

    5027797f2b19fcef4d4ad068ce01e387c5d191d499aab85ad7c0670b86a0a1f00c0504f9525f55111ba96972b7cb9f3851fedeb258f6e8c5f4d8fb3b4c7fd9f2

  • SSDEEP

    12288:lFngyTtGd5n/8n3FfDHuh6bUDD+4QACxKrI20ih//Xqc4SPIBxnF+Y0ZR:Tn1TQsrv4v+4nE2I2p/q32I/FF

Score
10/10
cobaltstrikebackdoortrojanupx

Malware Config

Extracted

Family

cobaltstrike

C2

http://xxxx.adobe-flash.ml:8080/images/logo2.png

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36 Host: xxxx.adobe-flash.ml

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ab704a3567195e5185a3ff61938cadf.exe
    "C:\Users\Admin\AppData\Local\Temp\9ab704a3567195e5185a3ff61938cadf.exe"
    1⤵
      PID:2424

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2424-0-0x0000000000400000-0x000000000062B000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/2424-1-0x0000000027BD0000-0x0000000027CD1000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/2424-2-0x0000000000400000-0x000000000062B000-memory.dmp

      Filesize

      2.2MB

      Download