Analysis
- max time kernel
92s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
27/06/2024, 15:23
General
- Target Timo.exe
- Size 192KB
- Sample240627-ssramaxeje
- SHA256 176e5d0fdb77b787e6ea0622eaffffde1ed810a14393b15f1793b51a57a50be9
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://weibogaming.icu:80/share.js
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Host: weibogaming.icu
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Timo.exe"C:\Users\Admin\AppData\Local\Temp\Timo.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4848-0-0x00007FFEE1F30000-0x00007FFEE1F40000-memory.dmp
memory/4848-1-0x0000000000020000-0x0000000000021000-memory.dmp
memory/4848-2-0x0000000002AA0000-0x0000000002EA0000-memory.dmp