Analysis

  • max time kernel
    0s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/10/2024, 05:28

Errors

Reason
platform exec: image=C:\Users\Admin\AppData\Local\Temp\2024-10-18_61dbbd28f2f85ca17fe25c34e7ac1299_cobalt-strike_ryuk.exe command="C:\Users\Admin\AppData\Local\Temp\2024-10-18_61dbbd28f2f85ca17fe25c34e7ac1299_cobalt-strike_ryuk.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

General

  • Target

    2024-10-18_61dbbd28f2f85ca17fe25c34e7ac1299_cobalt-strike_ryuk.exe

  • Size

    1.5MB

  • MD5

    61dbbd28f2f85ca17fe25c34e7ac1299

  • SHA1

    6226411a3240ec46ab27eb9f9ff040d41225219d

  • SHA256

    971c89f3f2cbc04d9fc2adee8a2b0432bf08918780f9f199d0070e6eb3f60436

  • SHA512

    98cbfb710182ebd92280d4b61920c497d7779564cce4ec929623f1412997731432b5cf50fde2de61c86f111dfcd456f93455660fcc6ee08c27ee0548d146029b

  • SSDEEP

    49152:7UxVQAmGVrz485TZhF1W4fkCks7R9L58UqFJjskU:O285T3CC17DVqFJU

Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-18_61dbbd28f2f85ca17fe25c34e7ac1299_cobalt-strike_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-18_61dbbd28f2f85ca17fe25c34e7ac1299_cobalt-strike_ryuk.exe"
    1⤵
      PID:2520

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2520-0-0x0000000140000000-0x0000000140194000-memory.dmp

            Filesize

            1.6MB