Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 16:07
General
-
Target
rundll.exe
-
Size
1.6MB
-
MD5
b6f38a50620db20ac5c231f924f3b4a5
-
SHA1
635d79bbab78af66e561e2146ed0f5926dc886fb
-
SHA256
24630db019f0de35f81c0a712d62ed04db084cdd287ea803f588e0f808186f98
-
SHA512
bf6fa80d2e973faab2bf8cdf35aa7a4975b511fe2175a57b4ba86c670a49fc17a8c2aa6389578df1cf6a065effc0057384873ff6215eca0cb693e77a3f8272ed
-
SSDEEP
12288:ehJK5SJT91q5uM97uyuYpxwu5T1v+rMORuIDJI4yN/6YYJNtuX3e9ifzRBexvVIx:kJP3qeyff5k+5/EP0+9ue52kaX58oj
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://79.110.52.22:443/components/as.png
Attributes
-
user_agent
Host: tgmcheck.com Connection: close User-Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rundll.exe"C:\Users\Admin\AppData\Local\Temp\rundll.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
536KB
-
Filesize
4.0MB
-
Filesize
8KB
-
Filesize
4.0MB