Overview

overview

10

Static

static

3

3b31c03485...ab.exe

windows7-x64

10

3b31c03485...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    06-08-2023 08:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab.exe

  • Size

    2.0MB

  • MD5

    31c981534683950dd0be7cf743d99dd9

  • SHA1

    07d4dc535e479b7bfb15be7b9a55f9d9e84e1537

  • SHA256

    3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab

  • SHA512

    61ded69ba8c4f5b3b5bad054e1ccc686275e76044f4bf33aac843512bd9b0413dc9bf7d2f1280e3f57ac5381d8fecb7eeb83ea29b1a2576a7e5df895e83cc5fe

  • SSDEEP

    49152:QdFHdj73vWrb/TyvO90d7HjmAFd4A64nsfJwWN9g3D1xCCgtg/h2wmMYN:03vW4qae

Score
10/10
cobaltstrike0305419896backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

Attributes
  • beacon_type

    512

  • http_header1

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • pipe_name

    \\.\pipe\foobar

  • polling_time

    10000

  • port_number

    4444

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCH+TuORWhlSvPRuBuEAFU4UHQuE+Zb23h0CGtYuEl2Mq6HaUbIgjN+kUhMWSmmmuCtxYweaey3BEL+wqNfF8nYVKN8J0REL4BwW/+KGMxUU7/MO69ki9BWayGjR389BS1axCnTqBZasMy1ngzZ1C1/3I+78usiennOuA0+o6dNCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • watermark

    305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab.exe
    "C:\Users\Admin\AppData\Local\Temp\3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab.exe"
    1⤵
      PID:1196

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1196-54-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-55-0x0000000027AF0000-0x0000000027BF0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/1196-56-0x0000000002020000-0x000000000206A000-memory.dmp
      Filesize

      296KB

      Download
    • memory/1196-57-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-58-0x0000000002020000-0x000000000206A000-memory.dmp
      Filesize

      296KB

      Download
    • memory/1196-59-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-60-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-61-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-62-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-63-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-64-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-65-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-66-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-67-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-68-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-69-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/1196-70-0x0000000000820000-0x0000000000A84000-memory.dmp
      Filesize

      2.4MB

      Download