Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
06-02-2023 14:00
General
-
Target
2023年2月6日主题党日学习材料-20230206.exe
-
Size
386KB
-
MD5
9e8b2ebfbd1cb5aa063acdd8beef4805
-
SHA1
c23febb0622b837243d2e8ee5c0ab3a70247d0b4
-
SHA256
f0683f97b29c1c9377a653999bd510e0e99876025300ca0a0c803931ce5a5687
-
SHA512
c06cc4b162a2898aa3c873a8270ce505d6065a24b6b5a65e320f6ea87a16bea9beb49436e69b0ad2d64634fdb712b94af823410aae9b6d888feb5bd1842ef018
-
SSDEEP
3072:deGS3FvUgI0xDy7HtyHQxtO4gATq2zI4wNTaxsjUM8eT9S3ID:LS3Laywxq2zI4sUM8eT9d
Malware Config
Extracted
cobaltstrike
0
http://service-avjzziu8-1253795072.gz.apigw.tencentcs.com:443/api/auth/v1/log
-
access_type
512
-
beacon_type
2048
-
dns_idle
1.920103026e+09
-
dns_sleep
2.281701376e+09
-
host
service-avjzziu8-1253795072.gz.apigw.tencentcs.com,/api/auth/v1/log
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAKAAAAJUFjY2VwdC1MYW5ndWFnZTogZW4tR0I7cT0wLjksICo7cT0wLjcAAAAKAAAAGENvbnRlbnQtVHlwZTogdGV4dC9wbGFpbgAAAAcAAAAAAAAAAwAAAAIAAAAJSlNFU1NJT049AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
jitter
9984
-
maxdns
245
-
polling_time
18016
-
port_number
443
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMBwlzJxqJdNKqYp0E8oXTNufnwWZ07HkSwIl2J/vKHT6cOVN6daVpSBMtW1cio3mN/kXEdczBCp8Kt6jya+daqD7xJ/Ah9TPdvtX7hDUtNoLcCphkQT/0eRlTAzC75MYhYeCjv3Duw1hQTG4cmmHLxMHThPLeR5S8L9HHXQCuPQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.481970944e+09
-
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/api/baidu/auth
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36
-
watermark
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Modifies system certificate store 2 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023年2月6日主题党日学习材料-20230206.exe"C:\Users\Admin\AppData\Local\Temp\2023年2月6日主题党日学习材料-20230206.exe"1⤵
- Modifies system certificate store
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
504KB
-
Filesize
4.0MB
-
Filesize
504KB
-
Filesize
4.0MB