Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 04:17
Static task
static1
Behavioral task
behavioral1
Sample
7c16bd6211f167043994fc70ccc51b562646e5cc39d12a695fba0998f5644882.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7c16bd6211f167043994fc70ccc51b562646e5cc39d12a695fba0998f5644882.exe
Resource
win10v2004-20240412-en
General
-
Target
7c16bd6211f167043994fc70ccc51b562646e5cc39d12a695fba0998f5644882.exe
-
Size
1.4MB
-
MD5
f2babb8ef0dacdb207210c4a23ac2878
-
SHA1
f26388aca91ca0238f7616f78394657a2958989f
-
SHA256
7c16bd6211f167043994fc70ccc51b562646e5cc39d12a695fba0998f5644882
-
SHA512
499ab0c79aaee1a2a78f2b79ca363d1230c0afd46aa551af5852e136ca4227ab2f9a53ebf197f550c150e0b89a1767b33707aa0edb3ba7a038c590a863c93050
-
SSDEEP
24576:7+kHrHeMeqRRdhyQjENp8xSgWxppFir5E:1beWLjuoWxjFg5E
Malware Config
Extracted
cobaltstrike
http://47.120.69.175:80/J6zc
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSE)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3980-0-0x000002468E3F0000-0x000002468E3F1000-memory.dmpFilesize
4KB