General
-
Target
cs.exe
-
Size
219KB
-
Sample
210924-rgvcgahbeq
-
MD5
b5ab07168c91bc36fe5d3511abb25e21
-
SHA1
726823b8a738adcdd796b3434c38893900b8f66f
-
SHA256
cd096ac92b773a4793a3e9ec31ac11c7057ff6784b0bb052eb43d54d5775bca0
-
SHA512
5e2f34d93be456b5abe94a468fd1d5d6e42a7c77a6db4f148f45fd93b80ff66537c358b833a6647ba943f4a3be69a271d914f5af1a748d1749ca375323da8903
Static task
static1
Behavioral task
behavioral1
Sample
cs.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
cs.exe
Resource
win10-en-20210920
Malware Config
Extracted
cobaltstrike
1359593325
http://round-truth-58c8.updatecheck.workers.dev:443/v1/updateCheck
-
access_type
512
-
beacon_type
2048
-
host
round-truth-58c8.updatecheck.workers.dev,/v1/updateCheck
-
http_header1
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAgAAAANAAAABgAAABJCSUdJcFNlcnZlclBPT0xfSUQAAAAJAAAACm9zbmFtZT13aW4AAAAJAAAADmNoYW5uZWw9c3RhYmxlAAAACQAAAAxtaWxlc3RvbmU9ODAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAYAAAALeC1jbGllbnQtaWQAAAAHAAAAAQAAAAMAAAAGAAAADngtZW5jcnlwdC1kYXRhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
5120
-
polling_time
10000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqVFrNofnr4vbdEXJaTCshcOIBqT62V48O48acveHm4RK3C9jVByRMc3bGp5zdHPVCsiPZ56T+dAje8SBq25M8oEisBJBlAYLlSRKREEhW8pYee7QAcaOrIUmAZ642scb+Dpro5DO+JW7i/PPk3rU/R9j5+NVY0vjbiVUG2FSvZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.448416512e+09
-
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/v1/releaseMgr
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebkit/537.36 Chrome/71.0.3578.98
-
watermark
1359593325
Targets
-
-
Target
cs.exe
-
Size
219KB
-
MD5
b5ab07168c91bc36fe5d3511abb25e21
-
SHA1
726823b8a738adcdd796b3434c38893900b8f66f
-
SHA256
cd096ac92b773a4793a3e9ec31ac11c7057ff6784b0bb052eb43d54d5775bca0
-
SHA512
5e2f34d93be456b5abe94a468fd1d5d6e42a7c77a6db4f148f45fd93b80ff66537c358b833a6647ba943f4a3be69a271d914f5af1a748d1749ca375323da8903
Score10/10 -