Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 03:40
General
- Target 3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81.exe
- Size 5.7MB
- Sample261002-d799qa1hpb
- SHA256 3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81
Malware Config
Extracted
-
cobaltstrike
-
391144938
-
http://139.9.243.130:443/sugrec
-
access_type
512
-
beacon_type
2048
-
host
139.9.243.130
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAATSG9zdDogd3d3LmJhaWR1LmNvbQAAAAoAAABGQ29va2llOiBaRF9FTlRSWT1nb29nbGU7IEJBSURVSUQ9NkMzQTgyNEI1RkUzMDdDRjIzNzE4QjgwNjNCMjI3MkQ6Rkc9MQAAAAcAAAAAAAAADwAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAATSG9zdDogd3d3LmJhaWR1LmNvbQAAAAoAAAAeQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uAAAACgAAAEZDb29raWU6IFpEX0VOVFJZPWdvb2dsZTsgQkFJRFVJRD02QzNBODI0QjVGRTMwN0NGMjM3MThCODA2M0IyMjcyRDpGRz0xAAAABwAAAAAAAAAPAAAADQAAAAUAAAAEdmlldwAAAAcAAAABAAAADwAAAA0AAAACAAAACHsiaW1nIjoiAAAAAQAAAAIifQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\WerFault.exe
-
sc_process64
%windir%\sysnative\WerFault.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq5FLm+lamnOskg6M7l5P1QuBtuz02ytCR+d7h4wJtc/zazWK296zCBGYq9IZfG5pywTRxxqnslPHFvh4ji4+48HaUOZz944lngUjayzPEICVgT1+siwKxVnBavgiQcYZ1Oi0xp57l4DYddiflzNO6LFYCAd4T/xVzr3vzZWpLMwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.126138112e+09
-
unknown2
AAAABAAAAAEAAAACAAAAAgAAAF0AAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/5aV1bjqh_Q23odCf/static/superman/img/topnav/
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
-
watermark
391144938
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81.exe"C:\Users\Admin\AppData\Local\Temp\3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2036-0-0x000000002A6E0000-0x000000002A732000-memory.dmp
memory/2036-1-0x000000002A280000-0x000000002A380000-memory.dmp
memory/2036-3-0x0000000000B00000-0x0000000000BBE000-memory.dmp
memory/2036-4-0x00000000012F0000-0x00000000015B9000-memory.dmp
memory/2036-2-0x0000000000300000-0x000000000092A000-memory.dmp
memory/2036-7-0x0000000001800000-0x000000000189E000-memory.dmp
memory/2036-6-0x0000000001170000-0x000000000119B000-memory.dmp
memory/2036-5-0x00000000010D0000-0x0000000001160000-memory.dmp
memory/2036-12-0x00000000011C0000-0x00000000011E2000-memory.dmp
memory/2036-17-0x0000000002910000-0x0000000002C65000-memory.dmp
memory/2036-19-0x0000000002870000-0x000000000290B000-memory.dmp
memory/2036-27-0x00000000299F0000-0x0000000029A02000-memory.dmp
memory/2036-35-0x000000002B490000-0x000000002B53D000-memory.dmp
memory/2036-34-0x000000002B1E0000-0x000000002B490000-memory.dmp
memory/2036-51-0x000000002CF60000-0x000000002CFF1000-memory.dmp
memory/2036-52-0x000000002A280000-0x000000002A380000-memory.dmp
memory/2036-50-0x000000002CE80000-0x000000002CF4D000-memory.dmp
memory/2036-49-0x000000002CE60000-0x000000002CE6C000-memory.dmp
memory/2036-48-0x000000002CE30000-0x000000002CE58000-memory.dmp
memory/2036-47-0x000000002CC40000-0x000000002CE2B000-memory.dmp
memory/2036-46-0x000000002C820000-0x000000002C828000-memory.dmp
memory/2036-45-0x000000002C810000-0x000000002C81B000-memory.dmp
memory/2036-44-0x000000002C7C0000-0x000000002C7FB000-memory.dmp
memory/2036-43-0x000000002C6B0000-0x000000002C7B8000-memory.dmp
memory/2036-42-0x000000002C690000-0x000000002C6A7000-memory.dmp
memory/2036-41-0x000000002C3A0000-0x000000002C449000-memory.dmp
memory/2036-40-0x000000002BD80000-0x000000002BD92000-memory.dmp
memory/2036-39-0x000000002BD60000-0x000000002BD7F000-memory.dmp
memory/2036-38-0x000000002BD00000-0x000000002BD55000-memory.dmp
memory/2036-37-0x000000002BCD0000-0x000000002BCFC000-memory.dmp
memory/2036-36-0x000000002B540000-0x000000002BCD0000-memory.dmp
memory/2036-33-0x000000002B170000-0x000000002B1DA000-memory.dmp
memory/2036-32-0x000000002B130000-0x000000002B161000-memory.dmp
memory/2036-31-0x000000002ADC0000-0x000000002ADE7000-memory.dmp
memory/2036-30-0x000000002AD80000-0x000000002ADB4000-memory.dmp
memory/2036-29-0x000000002A280000-0x000000002A298000-memory.dmp
memory/2036-28-0x000000002A740000-0x000000002AC10000-memory.dmp
memory/2036-26-0x00000000299A0000-0x00000000299EB000-memory.dmp
memory/2036-25-0x0000000004650000-0x00000000046D3000-memory.dmp
memory/2036-24-0x00000000045E0000-0x000000000464B000-memory.dmp
memory/2036-23-0x00000000045B0000-0x00000000045D7000-memory.dmp
memory/2036-22-0x0000000002760000-0x000000000276C000-memory.dmp
memory/2036-21-0x0000000002FA0000-0x0000000002FD0000-memory.dmp
memory/2036-20-0x0000000002C70000-0x0000000002D9A000-memory.dmp
memory/2036-18-0x0000000002720000-0x000000000274C000-memory.dmp
memory/2036-8-0x00000000018A0000-0x0000000001FDF000-memory.dmp
memory/2036-16-0x0000000002670000-0x000000000271C000-memory.dmp
memory/2036-15-0x0000000002770000-0x0000000002870000-memory.dmp
memory/2036-14-0x00000000025D0000-0x000000000266D000-memory.dmp
memory/2036-13-0x00000000024C0000-0x00000000025CB000-memory.dmp
memory/2036-10-0x0000000002190000-0x00000000022B5000-memory.dmp
memory/2036-11-0x000000002D000000-0x000000002D002000-memory.dmp
memory/2036-9-0x0000000001FE0000-0x0000000002181000-memory.dmp
memory/2036-168-0x0000000002C70000-0x0000000002D9A000-memory.dmp
memory/2036-266-0x0000000002C70000-0x0000000002D9A000-memory.dmp
memory/2036-298-0x0000000000300000-0x000000000092A000-memory.dmp
memory/2036-312-0x0000000002910000-0x0000000002C65000-memory.dmp
memory/2036-387-0x000000002C6B0000-0x000000002C7B8000-memory.dmp
memory/2036-378-0x000000002B1E0000-0x000000002B490000-memory.dmp
memory/2036-372-0x000000002A740000-0x000000002AC10000-memory.dmp
memory/2036-421-0x000000002A740000-0x000000002AC10000-memory.dmp
memory/2036-583-0x000000002C6B0000-0x000000002C7B8000-memory.dmp
memory/2036-592-0x0000000000300000-0x000000000092A000-memory.dmp
memory/2036-604-0x0000000002770000-0x0000000002870000-memory.dmp
memory/2036-600-0x0000000002190000-0x00000000022B5000-memory.dmp
memory/2036-597-0x0000000001800000-0x000000000189E000-memory.dmp