Analysis
-
max time kernel
95s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30/12/2024, 02:05
General
-
Target
cobahttpx86.exe
-
Size
2.7MB
-
MD5
5415d117067af06eca07d3eca2a77577
-
SHA1
6e018746c810c88adf7bccf570ff240056988c84
-
SHA256
5e6466283d75f4fdfb6dc2c6a6b249c441f0692c3a82521024fe53a19749c35e
-
SHA512
dcbcb53099cb0bb49e8538692fd20a96b152a791bb43a2c064f73145be38bdfac3b6388ab7144813fc6f58e8ce77afb2c46a00644c09f4e2d2244de56dea95c7
-
SSDEEP
49152:Ws6o30lU0jmz+3lnSvNw7jHgDLEShfQCmNm6AMd6grmevOZVer3U5E0ev5N0aGI8:Ws6o30lU0w+VnSvgwAU5Uv5QIZFpGHB3
Malware Config
Extracted
metasploit
windows/download_exec
http://195.123.217.12:80/jquery-3.3.1.slim.min.js
- headers Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cobahttpx86.exe"C:\Users\Admin\AppData\Local\Temp\cobahttpx86.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
4KB