Analysis
- max time kernel
131s - max time network
131s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/11/2020, 06:30
General
- Target 46693e0208c7bacac357ec9a2d0e84f7.exe
- Size 1.9MB
- Sample201105-bt1apb9wx2
- SHA256 fb780f623a78c9b5aa8a279430731b84d0efe937ea5684f80182e4f896e8e288
Malware Config
Extracted
-
metasploit
-
windows/download_exec
-
http://bakcup-monster.com:443/static-directory/ro.png
Extracted
-
cobaltstrike
-
http://mn.bakcup-monster.com:443/remove
-
http://nm.bakcup-monster.com:443/remove
-
http://ws.bakcup-monster.com:443/remove
-
access_type
512
-
beacon_type
2048
-
create_remote_thread
0
-
day
0
-
dns_idle
3.731859462e+09
-
dns_sleep
2.5165824e+09
-
host
mn.bakcup-monster.com,/remove,nm.bakcup-monster.com,/remove,ws.bakcup-monster.com,/remove
-
http_header1
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAASQWNjZXB0OiBpbWFnZS9qcGVnAAAACgAAABNBY2NlcHQtRW5jb2Rpbmc6IGJyAAAABwAAAAAAAAADAAAAAwAAAAIAAAAMcmVnX2ZiX2dhdGU9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAVQWNjZXB0LUVuY29kaW5nOiBnemlwAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAABAAAADwAAAAMAAAACAAAAB1dQTEFORz0AAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
- injection_process
-
jitter
9984
-
maxdns
247
-
month
0
- pipe_name
-
polling_time
57861
-
port_number
443
- proxy_password
- proxy_server
- proxy_username
-
sc_process32
%windir%\syswow64\regsvr32.exe
-
sc_process64
%windir%\sysnative\regsvr32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNPfWcRLa4mEhhiLv4fEPpvSNkabkgwAzQ+wUb8SfETsaN7aUTlm6sPu9BfmOdcdLlFP729nwzyEo4oaCuskBe28G/g5Mf76yNI/7eZEWHlfwU0nsVWO/XPek7XqyWJAmfTjn80TsQhEoZvvlQ7iiJRxpWn/YkOZQbEKlUtehNQQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
5.10860288e+08
-
unknown2
AAAABAAAAAIAAAFSAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
0
-
unknown4
0
-
unknown5
0
-
uri
/jp
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
-
year
0
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
-
C:\Users\Admin\AppData\Local\Temp\46693e0208c7bacac357ec9a2d0e84f7.exe"C:\Users\Admin\AppData\Local\Temp\46693e0208c7bacac357ec9a2d0e84f7.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4004-0-0x00000000001A0000-0x00000000001AB000-memory.dmp
memory/4004-1-0x000000006BAC0000-0x000000006BACD000-memory.dmp
memory/4004-2-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/4004-3-0x00000000040F0000-0x0000000004173000-memory.dmp
memory/4004-4-0x00000000040F0000-0x0000000004173000-memory.dmp