Analysis

  • max time kernel
    140s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 01:45

General

  • Target

    LisectAVT_2403002C_175.exe

  • Size

    19KB

  • MD5

    b285a8fc54bb40e5ffe68f93ffe9a2c6

  • SHA1

    647d45abb8572bb35cc1beb750607c5d6e5a73ba

  • SHA256

    2d1ebdca169932f877c5e88c794eb97e220002c8bb531e7587ac06dff129fc32

  • SHA512

    29f98986c7418c5100c635e8b0acdb6dede54b3d64a8fecbe1229771642fd296fcf1e561dc7d99da18c33e3ffbbd54be54dd35f344e14b80452e27de3e93e0cd

  • SSDEEP

    192:lV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2LjN/GcjWF8qa1Dojjgi:HqaCF31cix+Dc4zjIyFF46gi

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.50.141:8088/jw2J

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_175.exe
    "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_175.exe"
    1⤵
      PID:1952

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1952-0-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/1952-1-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB