Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 03:28
General
- Target eb99203676d28f1339f2b606162d1cf7c9a1ab43b6025eeb45012493d2e76327.exe
- Size 574KB
- Sample241107-d1d8psvbnf
- SHA256 eb99203676d28f1339f2b606162d1cf7c9a1ab43b6025eeb45012493d2e76327
Malware Config
Extracted
-
cobaltstrike
-
http://152.67.212.187:443/accelerate/irc/Z0LCY5JYZL5
-
user_agent
Accept: application/xml, image/*, application/json Accept-Language: nl-be Accept-Encoding: gzip, * User-Agent: Mozilla/5.0 (Windows NT 5.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb99203676d28f1339f2b606162d1cf7c9a1ab43b6025eeb45012493d2e76327.exe"C:\Users\Admin\AppData\Local\Temp\eb99203676d28f1339f2b606162d1cf7c9a1ab43b6025eeb45012493d2e76327.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\notepad.exenotepad.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2536-1-0x0000024CBE150000-0x0000024CBE151000-memory.dmp
memory/2536-3-0x0000024CBE150000-0x0000024CBE151000-memory.dmp
memory/2536-6-0x0000024CBFC80000-0x0000024CBFCFF000-memory.dmp
memory/2536-7-0x0000024CC0360000-0x0000024CC0760000-memory.dmp
memory/2536-8-0x0000024CBFD00000-0x0000024CBFD02000-memory.dmp
memory/2536-9-0x0000024CC0360000-0x0000024CC0760000-memory.dmp
memory/3516-0-0x00007FFB2F010000-0x00007FFB2F205000-memory.dmp
memory/3516-2-0x0000000000400000-0x0000000000482000-memory.dmp