Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe
-
Size
1.3MB
-
MD5
794053d4786123a47f884af5e13c5f9a
-
SHA1
1a05cbe8c778de9731f1b8ee78bbc17417d3a083
-
SHA256
16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f
-
SHA512
84ee11df4ac9ff055fd65daaa61010ba3e593444ae20347da34cbd048d9ceaef9b9b342e7a724f0a200136febdacd7e76d6e1210489dd6b1643f14af98c598c6
-
SSDEEP
24576:ggnEbBRn3hIZZlUmihksgi4jyKdg/e8mCPqjBWTGmv0oSRlRwFyt5aVWxlU:HCRRceRhkRi4jdW2PgTGM0oiwW5TbU
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://192.168.128.129:8080/XKrH
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe 2932 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe"C:\Users\Admin\AppData\Local\Temp\16775923469199d1f02fbfd4d6b4b8cd449ebc8045e7138c73615a0f3e4e7b5f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
PID:2932