Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 21:34
General
- Target b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae.exe
- Size 5.6MB
- Sample260916-1es63aee73
- SHA256 b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae
Malware Config
Extracted
-
cobaltstrike
-
http://39.104.77.83:8090/wHRL
-
user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Loads dropped DLL 6 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae.exe"C:\Users\Admin\AppData\Local\Temp\b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae.exe"C:\Users\Admin\AppData\Local\Temp\b17da1d51b1f483729997a9c3ed61daecc6349b54262a5f954c7f518f5ed59ae.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_ctypes.pyd
_socket.pyd
base_library.zip
libffi-7.dll
python38.dll
select.pyd
memory/5116-31-0x00007FFF9F880000-0x00007FFF9F8A6000-memory.dmp
memory/5116-36-0x00007FFF9F3D0000-0x00007FFF9F3DF000-memory.dmp
memory/5116-25-0x00007FFF88D80000-0x00007FFF891C4000-memory.dmp
memory/5116-38-0x000001E2115C0000-0x000001E2115C1000-memory.dmp
memory/5116-40-0x00007FFF9F3C0000-0x00007FFF9F3CD000-memory.dmp
memory/5116-39-0x00007FFF9DF70000-0x00007FFF9DF89000-memory.dmp
memory/5116-41-0x00007FFF88D80000-0x00007FFF891C4000-memory.dmp
memory/5116-42-0x00007FFF9F880000-0x00007FFF9F8A6000-memory.dmp