Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 03:40
General
- Target 3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81.exe
- Size 5.7MB
- Sample261002-d799qa1hpb
- SHA256 3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81
Malware Config
Extracted
-
cobaltstrike
-
391144938
-
http://139.9.243.130:443/sugrec
-
access_type
512
-
beacon_type
2048
-
host
139.9.243.130
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAATSG9zdDogd3d3LmJhaWR1LmNvbQAAAAoAAABGQ29va2llOiBaRF9FTlRSWT1nb29nbGU7IEJBSURVSUQ9NkMzQTgyNEI1RkUzMDdDRjIzNzE4QjgwNjNCMjI3MkQ6Rkc9MQAAAAcAAAAAAAAADwAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAATSG9zdDogd3d3LmJhaWR1LmNvbQAAAAoAAAAeQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uAAAACgAAAEZDb29raWU6IFpEX0VOVFJZPWdvb2dsZTsgQkFJRFVJRD02QzNBODI0QjVGRTMwN0NGMjM3MThCODA2M0IyMjcyRDpGRz0xAAAABwAAAAAAAAAPAAAADQAAAAUAAAAEdmlldwAAAAcAAAABAAAADwAAAA0AAAACAAAACHsiaW1nIjoiAAAAAQAAAAIifQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\WerFault.exe
-
sc_process64
%windir%\sysnative\WerFault.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq5FLm+lamnOskg6M7l5P1QuBtuz02ytCR+d7h4wJtc/zazWK296zCBGYq9IZfG5pywTRxxqnslPHFvh4ji4+48HaUOZz944lngUjayzPEICVgT1+siwKxVnBavgiQcYZ1Oi0xp57l4DYddiflzNO6LFYCAd4T/xVzr3vzZWpLMwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.126138112e+09
-
unknown2
AAAABAAAAAEAAAACAAAAAgAAAF0AAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/5aV1bjqh_Q23odCf/static/superman/img/topnav/
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
-
watermark
391144938
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81.exe"C:\Users\Admin\AppData\Local\Temp\3132daaf5588052fd4dcbe1d4b386d97615273311c77c42199e3cb5685133a81.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3312-1-0x000000002AA10000-0x000000002AB10000-memory.dmp
memory/3312-0-0x000000002ABF0000-0x000000002AC42000-memory.dmp
memory/3312-3-0x0000000001240000-0x0000000001307000-memory.dmp
memory/3312-2-0x0000000000690000-0x0000000000CBA000-memory.dmp
memory/3312-4-0x0000000001430000-0x00000000017D1000-memory.dmp
memory/3312-7-0x0000000001BF0000-0x0000000001C99000-memory.dmp
memory/3312-5-0x00000000018C0000-0x000000000195D000-memory.dmp
memory/3312-6-0x0000000001960000-0x000000000198A000-memory.dmp
memory/3312-10-0x0000000002570000-0x000000000267C000-memory.dmp
memory/3312-12-0x00000000028B0000-0x00000000029D1000-memory.dmp
memory/3312-27-0x0000000029F40000-0x0000000029F54000-memory.dmp
memory/3312-28-0x000000002AC50000-0x000000002AED3000-memory.dmp
memory/3312-41-0x000000002C750000-0x000000002C7F8000-memory.dmp
memory/3312-46-0x000000002D4C0000-0x000000002D4CE000-memory.dmp
memory/3312-51-0x000000002DA90000-0x000000002DA92000-memory.dmp
memory/3312-49-0x000000002D9C0000-0x000000002DA84000-memory.dmp
memory/3312-48-0x000000002D8D0000-0x000000002D9A6000-memory.dmp
memory/3312-47-0x000000002D6E0000-0x000000002D8B8000-memory.dmp
memory/3312-43-0x000000002D130000-0x000000002D256000-memory.dmp
memory/3312-50-0x000000002AA10000-0x000000002AB10000-memory.dmp
memory/3312-45-0x000000002D4B0000-0x000000002D4BA000-memory.dmp
memory/3312-44-0x000000002D470000-0x000000002D4A2000-memory.dmp
memory/3312-37-0x000000002BFB0000-0x000000002C083000-memory.dmp
memory/3312-36-0x000000002B780000-0x000000002BFAA000-memory.dmp
memory/3312-42-0x000000002D110000-0x000000002D128000-memory.dmp
memory/3312-33-0x000000002B480000-0x000000002B742000-memory.dmp
memory/3312-40-0x000000002C120000-0x000000002C13A000-memory.dmp
memory/3312-39-0x000000002C0F0000-0x000000002C119000-memory.dmp
memory/3312-38-0x000000002C090000-0x000000002C0ED000-memory.dmp
memory/3312-35-0x000000002AAF0000-0x000000002AAFD000-memory.dmp
memory/3312-34-0x000000002B750000-0x000000002B779000-memory.dmp
memory/3312-24-0x0000000004B30000-0x0000000004BA4000-memory.dmp
memory/3312-19-0x0000000003170000-0x0000000003286000-memory.dmp
memory/3312-16-0x0000000002DF0000-0x000000000316C000-memory.dmp
memory/3312-32-0x000000002B410000-0x000000002B478000-memory.dmp
memory/3312-31-0x000000002B3C0000-0x000000002B408000-memory.dmp
memory/3312-30-0x000000002B040000-0x000000002B078000-memory.dmp
memory/3312-29-0x000000002AA10000-0x000000002AA2C000-memory.dmp
memory/3312-26-0x0000000029EE0000-0x0000000029F2E000-memory.dmp
memory/3312-25-0x0000000004BB0000-0x0000000004C49000-memory.dmp
memory/3312-22-0x0000000002BD0000-0x0000000002BDC000-memory.dmp
memory/3312-21-0x0000000003490000-0x00000000034BF000-memory.dmp
memory/3312-20-0x0000000002B70000-0x0000000002BB0000-memory.dmp
memory/3312-18-0x0000000002A90000-0x0000000002B37000-memory.dmp
memory/3312-17-0x0000000002B40000-0x0000000002B6D000-memory.dmp
memory/3312-15-0x0000000002D30000-0x0000000002DE2000-memory.dmp
memory/3312-14-0x0000000002BE0000-0x0000000002D2B000-memory.dmp
memory/3312-23-0x0000000004AF0000-0x0000000004B26000-memory.dmp
memory/3312-8-0x0000000001CA0000-0x0000000002396000-memory.dmp
memory/3312-9-0x00000000023A0000-0x0000000002563000-memory.dmp
memory/3312-13-0x00000000029E0000-0x0000000002A83000-memory.dmp
memory/3312-11-0x0000000002880000-0x00000000028A7000-memory.dmp
memory/3312-78-0x000000002AC50000-0x000000002AED3000-memory.dmp
memory/3312-292-0x0000000000690000-0x0000000000CBA000-memory.dmp
memory/3312-306-0x0000000002DF0000-0x000000000316C000-memory.dmp
memory/3312-309-0x0000000003170000-0x0000000003286000-memory.dmp
memory/3312-366-0x000000002AC50000-0x000000002AED3000-memory.dmp
memory/3312-381-0x000000002D130000-0x000000002D256000-memory.dmp
memory/3312-371-0x000000002B480000-0x000000002B742000-memory.dmp
memory/3312-414-0x000000002AC50000-0x000000002AED3000-memory.dmp
memory/3312-573-0x000000002D130000-0x000000002D256000-memory.dmp
memory/3312-580-0x0000000000690000-0x0000000000CBA000-memory.dmp
memory/3312-585-0x0000000001BF0000-0x0000000001C99000-memory.dmp
memory/3312-592-0x0000000002BE0000-0x0000000002D2B000-memory.dmp
memory/3312-593-0x0000000002D30000-0x0000000002DE2000-memory.dmp
memory/3312-588-0x0000000002570000-0x000000000267C000-memory.dmp