Overview
overview
10Static
static
a0cc60b4fa...0f.exe
windows7-x64
3a0cc60b4fa...0f.exe
windows10-2004-x64
3a69cf4fa61...7f.exe
windows7-x64
10a69cf4fa61...7f.exe
windows10-2004-x64
10a6dbbf3d86...75.exe
windows7-x64
7a6dbbf3d86...75.exe
windows10-2004-x64
7a783bb9edd...09.exe
windows7-x64
10a783bb9edd...09.exe
windows10-2004-x64
10ac89e5c3ba...5a.exe
windows7-x64
10ac89e5c3ba...5a.exe
windows10-2004-x64
10b6d4c3b56c...24.exe
windows7-x64
3b6d4c3b56c...24.exe
windows10-2004-x64
3b91eb833de...81.exe
windows7-x64
10b91eb833de...81.exe
windows10-2004-x64
10b959b003c1...74.exe
windows7-x64
10b959b003c1...74.exe
windows10-2004-x64
10ba8824a7c7...63.exe
windows7-x64
7ba8824a7c7...63.exe
windows10-2004-x64
7c0f1ebcca8...4a.exe
windows7-x64
10c0f1ebcca8...4a.exe
windows10-2004-x64
10c3117be60e...ea.exe
windows7-x64
10c3117be60e...ea.exe
windows10-2004-x64
10c492754e6c...ef.exe
windows7-x64
3c492754e6c...ef.exe
windows10-2004-x64
3c9cc4d95ca...cd.exe
windows7-x64
10c9cc4d95ca...cd.exe
windows10-2004-x64
10ca4a22ce76...20.exe
windows7-x64
10ca4a22ce76...20.exe
windows10-2004-x64
10cb949ebe87...26.exe
windows7-x64
10cb949ebe87...26.exe
windows10-2004-x64
10cbc0718c3c...99.exe
windows7-x64
10cbc0718c3c...99.exe
windows10-2004-x64
10Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-09-2022 15:53
Static task
static1
Behavioral task
behavioral1
Sample
a0cc60b4fa8f29f5410424687c8f3e60b7f7b63c632fb506d2a42be45264de0f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a0cc60b4fa8f29f5410424687c8f3e60b7f7b63c632fb506d2a42be45264de0f.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
a6dbbf3d861bcc796d59c88856aa1537ad9929bb48026eade107b1ab504dbf75.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
a6dbbf3d861bcc796d59c88856aa1537ad9929bb48026eade107b1ab504dbf75.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
b6d4c3b56c0b12a12ff0e2baee3f46f4683f9e33a780c9631b61cf755eebc024.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
b6d4c3b56c0b12a12ff0e2baee3f46f4683f9e33a780c9631b61cf755eebc024.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
b91eb833de386ea3d73d2954f0dce9fe38e4bf96594620af6c0935b9ee0d7e81.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
b91eb833de386ea3d73d2954f0dce9fe38e4bf96594620af6c0935b9ee0d7e81.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
b959b003c1e558ff0ccf1d0f96509b155d6f86eb20caa97b470f3422494d8d74.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
b959b003c1e558ff0ccf1d0f96509b155d6f86eb20caa97b470f3422494d8d74.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
ba8824a7c7b7db0f89d566719b6a2c0893158b37b5ac45dd138acbdf6d7e9d63.exe
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
ba8824a7c7b7db0f89d566719b6a2c0893158b37b5ac45dd138acbdf6d7e9d63.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
c0f1ebcca8a8094853aa65210ddde80f6a9ffe7b3f2d75d5652b166722b3aa4a.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
c0f1ebcca8a8094853aa65210ddde80f6a9ffe7b3f2d75d5652b166722b3aa4a.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
c3117be60ef780dc86581052b5e3f72969bef6471c7218e35beec60d167eb4ea.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
c3117be60ef780dc86581052b5e3f72969bef6471c7218e35beec60d167eb4ea.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
c492754e6c21e22732ad1188c511745a3eea064696dc7f351d66e3c92bd63cef.exe
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
c492754e6c21e22732ad1188c511745a3eea064696dc7f351d66e3c92bd63cef.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
c9cc4d95ca1197328a743a41b09c2375d54ac97fcdde5e07bda660396710eccd.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
c9cc4d95ca1197328a743a41b09c2375d54ac97fcdde5e07bda660396710eccd.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
ca4a22ce761737a04ebdba0fd8063a81642d7d96fea052c8debe9acf7791df20.exe
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
ca4a22ce761737a04ebdba0fd8063a81642d7d96fea052c8debe9acf7791df20.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
Resource
win10v2004-20220812-en
General
-
Target
cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
-
Size
430KB
-
MD5
f380f09609171148b842223b439aad4c
-
SHA1
1cb9344fdbe5bc4830adb3fe36f71e0be3a5121f
-
SHA256
cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099
-
SHA512
abd83d2ee893f3a4bd05d76a2a73d7b01609bf3d5a415e29e93822d7ee0ff46c8844a642700121b852803458f3ced247233577072a4d8c2a377aec66b4879d86
-
SSDEEP
12288:dsOol4Xi9tQjNFrQ2RHJ2s843DdtCDVVscEfMDJ8t3+392Exh:dyxQjHHJ2s5BtYVnEfYM3eEExh
Malware Config
Extracted
cobaltstrike
1580103824
http://clippershipintl.com:443/safebrowsing/sj0IWAb/YhcZADXFB3NHbxFtKgpqBtK9BllJiGEL
-
access_type
512
-
beacon_type
2048
-
host
clippershipintl.com,/safebrowsing/sj0IWAb/YhcZADXFB3NHbxFtKgpqBtK9BllJiGEL
-
http_header1
AAAAEAAAABlIb3N0OiBDbGlwcGVyU2hpcEludGwuY29tAAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAcAAAAAAAAADQAAAAIAAAAOUkVGPUlEPU5ld3NYUWUAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABlIb3N0OiBDbGlwcGVyU2hpcEludGwuY29tAAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAcAAAAAAAAADQAAAAIAAAAJVT1OZXdzWFFlAAAAAgAAAAdSRUY9SUQ9AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
10240
-
polling_time
13000
-
port_number
443
-
sc_process32
%windir%\syswow64\WerFault.exe
-
sc_process64
%windir%\sysnative\WerFault.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnCZHWnYFqYB/6gJdkc4MPDTtBJ20nkEAd3tsY4tPKs8MV4yIjJb5CtlrbKHjzP1oD/1AQsj6EKlEMFIKtakLx5+VybrMYE+dDdkDteHmVX0AeFyw001FyQVlt1B+OSNPRscKI5sh1L/ZdwnrMy6S6nNbQ5N5hls6k2kgNO5nQ7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/safebrowsing/ngge/ouB3ZNRVgpN4hPOh0MEyV0gxkn0KKppxZqbFRay
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Edg/78.0.276.20
-
watermark
1580103824
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Detect Blister loader x64 2 IoCs
resource yara_rule behavioral31/files/0x00090000000139f7-55.dat family_blister_x64 behavioral31/memory/1844-56-0x000007FEF6CD0000-0x000007FEF6D72000-memory.dmp family_blister_x64 -
Loads dropped DLL 1 IoCs
pid Process 1844 cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
633KB
MD5229a758e232aeb49196c862655797e12
SHA173067102a6b37818f83121b9033087e291c667db
SHA25649ba10b4264a68605d0b9ea7891b7078aeef4fa0a7b7831f2df6b600aae77776
SHA512daf8f965e4f6f2b908c1dc104f4482412c6a972e58ee068774ca95f42a67ac5a91722909dd03b7101c0e4d5230befe6643c6d907d5170bf8321ab4960f3c0fae