Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 10:31
Static task
static1
Behavioral task
behavioral1
Sample
846ed999ad341be81b505fa19bea83508ccf025019049aabf63df719caa281d2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
846ed999ad341be81b505fa19bea83508ccf025019049aabf63df719caa281d2.exe
Resource
win10v2004-20240426-en
General
-
Target
846ed999ad341be81b505fa19bea83508ccf025019049aabf63df719caa281d2.exe
-
Size
1.2MB
-
MD5
771a20e342330c644860fe3382c21631
-
SHA1
5aea6dc83adaae0ddca520a33b215c50b9131a41
-
SHA256
846ed999ad341be81b505fa19bea83508ccf025019049aabf63df719caa281d2
-
SHA512
62d3feb4dc88ae92b9c8bca9b83f0bf74a074b1d8960ca9bf316c531a4510f0a5221d1ecc96683e5f5b84f0009714bd9f9d79a4a301218bd4061311939fe1484
-
SSDEEP
24576:vD5ydfVeBtvIACPUAYilGUNlkg/aj4/jJohXk7u350K1:vD8dfVADilGUHkg/qXIuJ0K1
Malware Config
Extracted
cobaltstrike
http://20.70.8.27:8888/YEOp
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MANM; MANM)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3580-0-0x00000200FF790000-0x00000200FF791000-memory.dmpFilesize
4KB