Analysis
-
max time kernel
31s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 23:56
Errors
Reason
Machine shutdown
General
-
Target
96c5bc2d8f5209fc194f7c9fbcb49a40265051c87abcc66bd9f8fcf8c69e75a3.exe
-
Size
12KB
-
MD5
5004d89c777e5d22c5a0b58d84221625
-
SHA1
a3c3ef420954fec59daad895af12ac1c9e235400
-
SHA256
96c5bc2d8f5209fc194f7c9fbcb49a40265051c87abcc66bd9f8fcf8c69e75a3
-
SHA512
5aadbe3344c5d1ef0711e90fb30380d9c046493a84d27765f53f2665306c2f962292504d3776867fbf82d580bd5e7408016a1c2349341d64fe81fe38047344d9
-
SSDEEP
192:JgK3rbcdWSiCVq1sHfvma6pNqlP07TI+sQ5tfBDvBu6sLCl8:JgK3rfqqC3mavlYssu6sLQ8
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://www.bilibli.mom:80/zzzzx
Attributes
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: www.bilibli.mom
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c5bc2d8f5209fc194f7c9fbcb49a40265051c87abcc66bd9f8fcf8c69e75a3.exe"C:\Users\Admin\AppData\Local\Temp\96c5bc2d8f5209fc194f7c9fbcb49a40265051c87abcc66bd9f8fcf8c69e75a3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.0MB
-
Filesize
4.4MB
-
Filesize
16KB
-
Filesize
4.0MB