Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-01-2021 22:23
Static task
static1
Behavioral task
behavioral1
Sample
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3.exe
Resource
win10v20201028
General
-
Target
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3.exe
-
Size
277KB
-
MD5
9b8892d3af5dcca1022eaeabc2948074
-
SHA1
207e448a72aadde3c1c13bb1be3c2ddb3fcc89d8
-
SHA256
2a1a3f6f1f138cf46a4aca66b22a2d4298a12e2115511127919a63b9150f4aa3
-
SHA512
f3053f3cffba152098cdaee1513522fe0ab3edc053b5c372d5ac3e65391f51c4054e595db2dfa155b9d6475e63eba3e8e18d86cc82d1935f94d74116b0e36f95
Malware Config
Extracted
cobaltstrike
http://213.135.78.244:443/hr.css
-
access_type
512
-
beacon_type
2048
-
create_remote_thread
0
-
day
0
-
dns_idle
0
-
dns_sleep
1.6777216e+08
-
host
213.135.78.244,/hr.css
-
http_header1
AAAAEAAAABRIb3N0OiBuczEucmVkdGVhbS5ydQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAPUFjY2VwdC1MYW5ndWFnZTogZnItQ0gsIGZyO3E9MC45LCBlbjtxPTAuOCwgZGU7cT0wLjcsICo7cT0wLjUAAAAHAAAAAAAAAAMAAAADAAAAAgAAACt3b3JkcHJlc3NfZWQxZjYxN2JiZDZjMDA0Y2MwOWUwNDZmM2MxYjcxNDg9AAAABgAAAAZDb29raWUAAAAJAAAADGNvbXBhbnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAAEAAAABRIb3N0OiBuczEucmVkdGVhbS5ydQAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAGENvbnRlbnQtVHlwZTogdGV4dC9wbGFpbgAAAAcAAAABAAAACwAAAAMAAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
- injection_process
-
jitter
10496
-
maxdns
250
-
month
0
- pipe_name
-
polling_time
3000
-
port_number
443
- proxy_password
- proxy_server
- proxy_username
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPZKC+d3OyhV69kk6cGbPoYKTNrNH2sYMeWXGPxQBx5lnHleIFkX3RTzNGyie4YHpwQvslXPmPxbPywD3W9lLsU6hrvNs1mHxIXqe8d6fe2KLThQIzh29Z2KWyIuTSoOiJos0doSdrrs0g8eUNEZUGwnqJY/Lq2wAmlXNcyYBFAQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.641697792e+09
-
unknown2
AAAABAAAAAIAAAPVAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
0
-
unknown4
0
-
unknown5
1
-
uri
/tab_shop_active
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
-
year
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.