cobaltstrike | b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe
Size 422KB
Sample240619-lkpcqsselk
SHA256 b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd
MD5 01f5685a4cc149bce7da388686d07145
SHA1 0f7c1abb6fa5e737f95bbe4ca364d5f92c8411bc
SHA512 5bec4c0efcdd17093f386dc7f01ae1af0a241f8d3792a157a1bb92d4c538d949c7b0e7e781cc8648b317f153236f43e5c8a80094c0033d6d4a094447146640b2
SSDEEP 6144:BCGaECnpAoDO1A8dg3iTPJLMfgQDxVUrRxX1sFOO4c4pE1:cGHCnaomAEg3uPdkgUxyRxX1sfMpE1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://120.46.145.214:6666/Est1

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe

Executes dropped EXE 1 IoCs

pid	Process
3400	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3400	3456	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe	83
PID 3456 wrote to memory of 3400	3456	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe	83
PID 3456 wrote to memory of 4948	3456	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe	85
PID 3456 wrote to memory of 4948	3456	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe	85
PID 3456 wrote to memory of 4948	3456	b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe	85
PID 4948 wrote to memory of 912	4948	AcroRd32.exe	87
PID 4948 wrote to memory of 912	4948	AcroRd32.exe	87
PID 4948 wrote to memory of 912	4948	AcroRd32.exe	87
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3524	912	RdrCEF.exe	88
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89
PID 912 wrote to memory of 3644	912	RdrCEF.exe	89

C:\Users\Admin\AppData\Local\Temp\b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe
"C:\Users\Admin\AppData\Local\Temp\b9e85336b1241a4dc3229883baf954b46465b6888ce8565fec630148568d28dd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\关于开展优秀员工评选的通知.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9321D84F4BBD2474697B7347D20EBBF5 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4D67F9CD91918C6659B009B0A4E231DF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4D67F9CD91918C6659B009B0A4E231DF --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4D689692659CF28A1A304731E8C74461 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A2FE0CE9455300964941A3824FA54F4B --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6AEE0D490DABF7760F92F1FA1111B04A --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:392
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F4753F148E9B52E6EAB3C12CD9181CA4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F4753F148E9B52E6EAB3C12CD9181CA4 --renderer-client-id=7 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 86f2a8a146f17f116e43469e14628b8685b5dddf5ca73521a62542739b0a00c2
MD5 fe5a4f2a5e2916342be79e3bcd93cdbf
SHA1 af3b52158c9c8588c069ad4e9c7d5cf14a70b353
SHA512 34d3ce0bbbe1e30789be1d5ede306e99463c6861499d6582345809de09cc13f9f199d7fc380a51d209559d7f362ac4c1dfb9d737c1c07b7e88948f1fc7eb0614
SSDEEP 384:yeMdThPstELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2s+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Temp\test.exe
Size 17KB
SHA256 f358c59fb898bb4b6e0c03072c2f9798536cc20c08a2524b809419602fd78b1f
MD5 3e679a50ff17f3a8c29131ca142d1d7e
SHA1 2cc3ade8e6f6d5577d188f1afb1618e1bf68d219
SHA512 3dba785fba98265b5943b53f3b8336c4f12cfededfb75eb8e395c16ddfdbcdd005017b2c066583bfa823a5f9e1c9286832a34b169263b283b18fc3966fab9851
SSDEEP 192:IDMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4Pf8jto7BUbOj6kxiY:IDMAoKz6WtKEj7aBDi+fSibAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

关于开展优秀员工评选的通知.pdf

Path C:\Users\Admin\AppData\Local\Temp\关于开展优秀员工评选的通知.pdf
Size 78KB
SHA256 a0145ae7ca6252dba6a6605aaf588a68159550046b4c94b9124ca3a4d8e296bb
MD5 07971b5ace8f2389f5a1fd82cfa16791
SHA1 802ff70f1ed93055413885e9278ee7c82ec79472
SHA512 41bbdba7b5fd01ff73740a194ec29eae2573f56bbbf68d35b6968c5422c1790e140c46774dc7421206c1f19be549822071b1feed069b93cfce825217f27a31cb
SSDEEP 1536:NdADmjoSVV9n/UQj3ZUkTIeohai1WWvKhbCazKLxab7NwZh9rU8+:NdXP9cQrZU9aiZwzKkb7NKwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3400-15-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/3400-44-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads