General
-
Target
cs.exe
-
Size
219KB
-
Sample
211104-2jxkqaehfn
-
MD5
3ceb4fc3918812690613424a566911b3
-
SHA1
877440408ff3f96708a02635509ae978ddfc6ce5
-
SHA256
3f6429ae16f098c2ba18ebd0f75c7f72cee70350cccb134c8926bae28038399f
-
SHA512
036cd0abd2d4cc191f004c2566a171a404d5d7709b5dd9647a4ed34416331044a02c7d1af7c6ae2edbdc479c22b3ea68c2ef0aa62faa63de95373a19ae24e05f
Static task
static1
Behavioral task
behavioral1
Sample
cs.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
cs.exe
Resource
win10-en-20211014
Malware Config
Extracted
cobaltstrike
1359593325
http://round-truth-58c8.updatecheck.workers.dev:443/v1/updateCheck
-
access_type
512
-
beacon_type
2048
-
host
round-truth-58c8.updatecheck.workers.dev,/v1/updateCheck
-
http_header1
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAgAAAANAAAABgAAABJCSUdJcFNlcnZlclBPT0xfSUQAAAAJAAAACm9zbmFtZT13aW4AAAAJAAAADmNoYW5uZWw9c3RhYmxlAAAACQAAAAxtaWxlc3RvbmU9ODAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACJBY2NlcHQ6IHRleHQvaHRtbCwgdGV4dC9wbGFpbiwgKi8qAAAACgAAAExBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC44LHpoLVRXO3E9MC43LHpoLUhLO3E9MC41LGVuLVVTO3E9MC4zLGVuO3E9MC4yAAAACgAAABZDb25uZWN0aW9uOiBLZWVwLUFsaXZlAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAADQAAAAYAAAALeC1jbGllbnQtaWQAAAAHAAAAAQAAAAMAAAAGAAAADngtZW5jcnlwdC1kYXRhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
5120
-
polling_time
10000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqVFrNofnr4vbdEXJaTCshcOIBqT62V48O48acveHm4RK3C9jVByRMc3bGp5zdHPVCsiPZ56T+dAje8SBq25M8oEisBJBlAYLlSRKREEhW8pYee7QAcaOrIUmAZ642scb+Dpro5DO+JW7i/PPk3rU/R9j5+NVY0vjbiVUG2FSvZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.448416512e+09
-
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/v1/releaseMgr
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebkit/537.36 Chrome/71.0.3578.98
-
watermark
1359593325
Targets
-
-
Target
cs.exe
-
Size
219KB
-
MD5
3ceb4fc3918812690613424a566911b3
-
SHA1
877440408ff3f96708a02635509ae978ddfc6ce5
-
SHA256
3f6429ae16f098c2ba18ebd0f75c7f72cee70350cccb134c8926bae28038399f
-
SHA512
036cd0abd2d4cc191f004c2566a171a404d5d7709b5dd9647a4ed34416331044a02c7d1af7c6ae2edbdc479c22b3ea68c2ef0aa62faa63de95373a19ae24e05f
Score10/10 -