Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
26-07-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe
Resource
win10v2004-20220721-en
General
-
Target
5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe
-
Size
403KB
-
MD5
fc24c7d2a82d23359b8d4a38bdde108d
-
SHA1
af11bd94bf1f76a201db9f5f0f47a4845e48cdfd
-
SHA256
5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9
-
SHA512
4869f6a13cbff55b86af6b26e69fac60793ee4b92c90c153527b1d1b4bd4f9c05fce7e53e41102fba2f66dbaba44f9048bb3ec3f4ffcd477b49c7b49ae672587
Malware Config
Extracted
cobaltstrike
1
http://service-4j8u5xfz-1313036808.sh.apigw.tencentcs.com:443/passApi/html/_blank.html
-
access_type
512
-
beacon_type
2048
-
host
service-4j8u5xfz-1313036808.sh.apigw.tencentcs.com,/passApi/html/_blank.html
-
http_header1
AAAACgAAABxVcGdyYWRlLUluc2VjdXJlLVJlcXVlc3RzOiAxAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAAFQU5JRD0AAAACAAAAGV9fU2VjdXJlLTNQQVBJU0lEPW5vc2tpbjsAAAABAAAAIztDT05TRU5UPVlFUytDTi56aC1DTisyMDIxMDkxNy0wOS0wAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOAAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAKAAAAGENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MAAAAAoAAAAfUmVmZXJlcjogaHR0cHM6Ly93d3cuYmFpZHUuY29tLwAAAAoAAAAcVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQAAAAcAAAAAAAAADQAAAAUAAAAIX19mb3JtaWQAAAAJAAAADmFwX2lkPWZrc2RVZEdXAAAACQAAABluZXdidXllcm5hbWU9bWJkWlNnSnZFR3BpAAAACQAAABZmaWVsZG5hbWU9RnNMS25hQ3VCdmVvAAAABwAAAAEAAAANAAAAAgAAAClhaWRfPTAwMDAwMDAwJmFjY3Zlcj0xJnNob3d0eXBlPWVtYmVkJnVhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
4864
-
polling_time
23000
-
port_number
443
-
sc_process32
%windir%\syswow64\gpupdate.exe
-
sc_process64
%windir%\sysnative\gpupdate.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsEmxfKMYC5LiUpKEMysDw5RhiFkIv7c6+EWluHiIuCfVd7tNDkMPj+o8rkg7TnhFLVceHaB33aSx/h0YQXJ6QLAldtmRN6iAYB+cfGhE/9B2LEllnHXyBEUiNoki/qP1JVMO8ohGBGMcGOWPgmPfkDthg0ObBvGVfzzXST0PX1wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.481970944e+09
-
unknown2
AAAABAAAAAEAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/v2/api/
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
-
watermark
1
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exedescription pid process target process PID 2024 wrote to memory of 2028 2024 5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe notepad.exe PID 2024 wrote to memory of 2028 2024 5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe notepad.exe PID 2024 wrote to memory of 2028 2024 5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe notepad.exe PID 2024 wrote to memory of 2028 2024 5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe"C:\Users\Admin\AppData\Local\Temp\5a5fa6186f420e5714ac13a4e0623ea2430aa5a1f9370f0848b4a11f3efe3dd9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\windows\notepad.exe"c:\windows\notepad.exe"2⤵PID:2028