Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
19/07/2024, 15:52
General
- Target babd607177d1519c1d52b0dd33e165d43ca51a9bc0a30ee380c21f98e9d361ae.exe
- Size 19KB
- Sample240719-ta4zfasbrb
- SHA256 babd607177d1519c1d52b0dd33e165d43ca51a9bc0a30ee380c21f98e9d361ae
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://74.48.57.53:20245/static-directory/nl.gif
Attributes
-
user_agent
Host: vuejs.org Connection: close Accept: */* Accept-Encoding: gzip User-Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
-
C:\Users\Admin\AppData\Local\Temp\babd607177d1519c1d52b0dd33e165d43ca51a9bc0a30ee380c21f98e9d361ae.exe"C:\Users\Admin\AppData\Local\Temp\babd607177d1519c1d52b0dd33e165d43ca51a9bc0a30ee380c21f98e9d361ae.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4804-0-0x0000000000020000-0x0000000000021000-memory.dmp
memory/4804-3-0x00000000009F0000-0x0000000000A7D000-memory.dmp
memory/4804-4-0x0000000003C90000-0x0000000003DEA000-memory.dmp
memory/4804-5-0x0000000000A80000-0x0000000000A82000-memory.dmp
memory/4804-6-0x0000000000400000-0x000000000040C000-memory.dmp
memory/4804-8-0x0000000003C90000-0x0000000003DEA000-memory.dmp