Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 15:52
Behavioral task
behavioral1
Sample
2024-10-14_4e5ea69d20d5839eb5816a4881d496b0_cobalt-strike_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-14_4e5ea69d20d5839eb5816a4881d496b0_cobalt-strike_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-14_4e5ea69d20d5839eb5816a4881d496b0_cobalt-strike_mafia.exe
-
Size
554KB
-
MD5
4e5ea69d20d5839eb5816a4881d496b0
-
SHA1
81bafc7b372d962407465deb21e7a8d799cebe7c
-
SHA256
d9824f78beae68906015e219c21a3d5a08568a4a4be3bec4d92ea1fa5fb37280
-
SHA512
12b25d0552f8d1e4e53303eaab740c1fbc02404ba3937e3932fe78089cb5f0a067e947520a39d1068b45307bfaf9168093e36b9f76200155b1d5835bd8abdeb9
-
SSDEEP
12288:7R8ofjYythWhQpMDfidyUs2yybb/0Ix6BY/sWNP:qirmQCDfi4UsZybbLU3k
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2940 1236 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-14_4e5ea69d20d5839eb5816a4881d496b0_cobalt-strike_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_4e5ea69d20d5839eb5816a4881d496b0_cobalt-strike_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_4e5ea69d20d5839eb5816a4881d496b0_cobalt-strike_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 2762⤵
- Program crash
PID:2940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1236 -ip 12361⤵PID:4508