Overview

overview

10

Static

static

3eae63f6cc...82.exe

windows7-x64

10

3eae63f6cc...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3eae63f6ccc836090a020988f5aa654cb7b99a8ad5d7feec918852d050750482

  • Size

    1.9MB

  • Sample

    220901-mnfensedd3

  • MD5

    c812ef291c2b9711c3566c44e6a3f143

  • SHA1

    09a6ab08244ae284c7a9b93ae457be1d46bfe40b

  • SHA256

    3eae63f6ccc836090a020988f5aa654cb7b99a8ad5d7feec918852d050750482

  • SHA512

    5e96aa4579e52393478e4b1859be4236eb722882935b6548a288314839bf02a74d3ab9f87b623d6f61eeed6fa28cfe2c45e4f05a0a89f61866acd6af12f5f21b

  • SSDEEP

    24576:UAK38HHY72CcJJF/5bAfUo1veNSFnwohhOcDVK65DjHxYSb1v9WugiXDcqxvg/8n:UUX5oS9UDN5jpvC8b1J

Score
10/10
cobaltstrike305419896backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://43.142.80.49:443/search

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    43.142.80.49,/search

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAA4Q29va2llOiBEVVA9UT1HcE8xbkpwTW5hbTRVbGxFZm1lTWRnMiZUPTI4Mzc2NzA4OCZBPTEmSUcAAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vd3d3LmNsb3VkLnRlbmNlbnQuY29tAAAABwAAAAAAAAADAAAAAgAAAApTRVNTSU9OSUQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAA4Q29va2llOiBEVVA9UT1HcE8xbkpwTW5hbTRVbGxFZm1lTWRnMiZUPTI4Mzc2NzA4OCZBPTEmSUcAAAAHAAAAAAAAAAMAAAACAAAACUpTRVNTSU9OPQAAAAYAAAAGQ29va2llAAAABwAAAAEAAAADAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2560

  • maxdns

    255

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTUlJ7J79z/MkkV8+MsYlOvREE2hhdGNzrKPFZ10lY0K5legA+um5JxESEaC0woDgSmOGrkh1giz/aQwd6tG4mihFgpi0oIbfwu6XZbE6ghYGyu2F7+A5TifRUzvU0YLXjK78EW12XhjHx4KopMF/AtOAueGwfiI2DmXwNzrBDvwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    3.82554112e+09

  • unknown2

    AAAABAAAAAEAAANBAAAAAgAAAqMAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /switch

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

  • watermark

    305419896

Targets

    • Target

      3eae63f6ccc836090a020988f5aa654cb7b99a8ad5d7feec918852d050750482

    • Size

      1.9MB

    • MD5

      c812ef291c2b9711c3566c44e6a3f143

    • SHA1

      09a6ab08244ae284c7a9b93ae457be1d46bfe40b

    • SHA256

      3eae63f6ccc836090a020988f5aa654cb7b99a8ad5d7feec918852d050750482

    • SHA512

      5e96aa4579e52393478e4b1859be4236eb722882935b6548a288314839bf02a74d3ab9f87b623d6f61eeed6fa28cfe2c45e4f05a0a89f61866acd6af12f5f21b

    • SSDEEP

      24576:UAK38HHY72CcJJF/5bAfUo1veNSFnwohhOcDVK65DjHxYSb1v9WugiXDcqxvg/8n:UUX5oS9UDN5jpvC8b1J

    Score
    10/10
    cobaltstrike305419896backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks