Analysis
- max time kernel
112s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
30/03/2024, 06:58
General
- Target 53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b.exe
- Size 349KB
- Sample240330-hrlcwabc93
- SHA256 53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://fluffy-teletype-gw.aws-euc1.cloud-ara.tyk.io:443/api/v2/GetAttachment
Attributes
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (X11; CrOS x86_64; AppleWebKit/537.36; Chrome/112.0.0.0; Safari/537.36; uacq)
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
-
C:\Users\Admin\AppData\Local\Temp\53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b.exe"C:\Users\Admin\AppData\Local\Temp\53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2344-0-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2344-1-0x0000000002E70000-0x00000000032E2000-memory.dmp
memory/2344-2-0x0000000002A70000-0x0000000002E70000-memory.dmp
memory/2344-3-0x0000000002170000-0x0000000002172000-memory.dmp