Analysis
-
max time kernel
145s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-12-2024 17:50
General
-
Target
a06497a848d59ffbc03a81f6a212f76b8b1dfdd87d9e99c955e48f6ceb8e18ca.exe
-
Size
560KB
-
MD5
cb7b63672287f4257083ecadacb636df
-
SHA1
56235bdd14f53ee89f9b093e663f9022e4bb779e
-
SHA256
a06497a848d59ffbc03a81f6a212f76b8b1dfdd87d9e99c955e48f6ceb8e18ca
-
SHA512
1739a8c3182ae88e95f28b0275ec6d4f95d6d165542bf2c373051d07a7359ca180d453a0485171e29e3235d97ff40b871d018a4e7afa08ae105fcf889f7e1a55
-
SSDEEP
6144:8HoVRkA+nAbQY5x+5KV/50h7btoDt5qagBv0TIJu+3GXNHTM9gaxRTKp9dm2ua7q:mAPzdVh0hnK3Tf+2dzMe2Kua7MX+r6
Malware Config
Extracted
cobaltstrike
305419896
http://192.168.239.129:17822/pixel
-
access_type
512
-
host
192.168.239.129,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
17822
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDACmrc5Fuixyid7WGWnKJUH/jUz0R3Qrm8sxQf+JL9yD3OJUPewVI3wN5QlEpgl6Hbcd6A00fRl9SDpaSbropmNKepwq+BO4ubW86llxXOR6bd7WXEp8IegFnb6NR+Ju+biW/bv5BcO434b7zaFvgfLm2tfKVorF5bGJHo4suliQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MATMJS)
-
watermark
305419896
Extracted
cobaltstrike
0
-
watermark
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06497a848d59ffbc03a81f6a212f76b8b1dfdd87d9e99c955e48f6ceb8e18ca.exe"C:\Users\Admin\AppData\Local\Temp\a06497a848d59ffbc03a81f6a212f76b8b1dfdd87d9e99c955e48f6ceb8e18ca.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
592KB
-
Filesize
592KB