Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2024 11:13

General

  • Target

    temp/CS4.9/cobaltstrike-client.jar

  • Size

    24.4MB

  • MD5

    a09b2907278a6452d91ed4dbd9798e38

  • SHA1

    26cffb1154cd9e50098fa1604df868facd4f9bae

  • SHA256

    e6625119e4491a1bd42849778816250f4658fac1d5554fd51e5ba67e0b244f56

  • SHA512

    9454f1ad2e21932e47047812655e7ba53faeccf941d92baa755e24254cb890931455086b3e92d5c644315d584d2e3310a4cc8693cc62d9d0f5ba1dae02c9a74d

  • SSDEEP

    786432:jXWN48462ATqLG7NnX0EGqIIV7+85uRLben0GS:rXnpUqLAZBIIV7qLa05

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\temp\CS4.9\cobaltstrike-client.jar
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2728-2-0x0000000002530000-0x00000000027A0000-memory.dmp

    Filesize

    2.4MB

  • memory/2728-16-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

  • memory/2728-15-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

  • memory/2728-18-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2728-25-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2728-27-0x0000000002530000-0x00000000027A0000-memory.dmp

    Filesize

    2.4MB

  • memory/2728-28-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

  • memory/2728-29-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB