Analysis
-
max time kernel
127s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-02-2022 23:28
Static task
static1
Behavioral task
behavioral1
Sample
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exe
Resource
win10v2004-en-20220113
General
-
Target
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exe
-
Size
633KB
-
MD5
c23e8aacaeb1d23041a7f1d0b70ac9ee
-
SHA1
b6a46cc2b0523238b120b14b52f5f4902e088667
-
SHA256
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369
-
SHA512
3883e1200e6665442e21fc0159389789677629a304b056226e15e331cc00e386b407b8f904af6ef0b544acf8099fd769ee82da5db7581f51af544dd6f8412061
Malware Config
Extracted
metasploit
windows/download_exec
http://185.150.119.157:80/static-directory/kj.png
- headers Host: citrixseruritys.com Connection: close User-Agent: Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
Extracted
cobaltstrike
1359593325
http://185.150.119.157:80/ml.css
-
access_type
512
-
host
185.150.119.157,/ml.css
-
http_header1
AAAAEAAAABlIb3N0OiBjaXRyaXhzZXJ1cml0eXMuY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAcAAAAAAAAADQAAAAMAAAACAAAAK3dvcmRwcmVzc181MjIzODU1OGU5MzBmMWVjNjk5ZTRmMTJhYjAxNWE0Zj0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABlIb3N0OiBjaXRyaXhzZXJ1cml0eXMuY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAoAAAAYQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluAAAABwAAAAEAAAADAAAAAwAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
10496
-
polling_time
62412
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJvC2CQYaIouT41kXKVNrM5lLvclGJRE+i3ves+vC0AADUWTPs64Dn/B4eKlQKPpbC/8IgJjadD/B9pZiY8XUlk4dvaagLdjBCq7uSxS+KhVVsX46LBSBgIxaE4AeoZvwBD2n0wdeeI2sbkMvDhhv5s6Nmz12sAtOVGdr8cX3s5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.17567488e+09
-
unknown2
AAAABAAAAAIAAAPVAAAAAwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/FAQ
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
-
watermark
1359593325
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exepid process 1724 a9eba0329eea37792ff440b3bcc85f5998caad3f046882a169e0d44c0e9c9369.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1724-54-0x0000000076491000-0x0000000076493000-memory.dmpFilesize
8KB
-
memory/1724-55-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1724-56-0x00000000003C0000-0x00000000003C5000-memory.dmpFilesize
20KB
-
memory/1724-57-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1724-58-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1724-59-0x0000000003BC0000-0x0000000003BF5000-memory.dmpFilesize
212KB
-
memory/1724-60-0x0000000004890000-0x0000000004C90000-memory.dmpFilesize
4.0MB