Overview

overview

10

Static

static

3

3b31c03485...ab.exe

windows7-x64

10

3b31c03485...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2023 08:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab.exe

  • Size

    2.0MB

  • MD5

    31c981534683950dd0be7cf743d99dd9

  • SHA1

    07d4dc535e479b7bfb15be7b9a55f9d9e84e1537

  • SHA256

    3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab

  • SHA512

    61ded69ba8c4f5b3b5bad054e1ccc686275e76044f4bf33aac843512bd9b0413dc9bf7d2f1280e3f57ac5381d8fecb7eeb83ea29b1a2576a7e5df895e83cc5fe

  • SSDEEP

    49152:QdFHdj73vWrb/TyvO90d7HjmAFd4A64nsfJwWN9g3D1xCCgtg/h2wmMYN:03vW4qae

Score
10/10
cobaltstrike0305419896backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

Attributes
  • beacon_type

    512

  • http_header1

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • pipe_name

    \\.\pipe\foobar

  • polling_time

    10000

  • port_number

    4444

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCH+TuORWhlSvPRuBuEAFU4UHQuE+Zb23h0CGtYuEl2Mq6HaUbIgjN+kUhMWSmmmuCtxYweaey3BEL+wqNfF8nYVKN8J0REL4BwW/+KGMxUU7/MO69ki9BWayGjR389BS1axCnTqBZasMy1ngzZ1C1/3I+78usiennOuA0+o6dNCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • watermark

    305419896

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab.exe
    "C:\Users\Admin\AppData\Local\Temp\3b31c03485aca944b2cf7929a27edfebb2ae042d1c9e45fae84796b0690b7dab.exe"
    1⤵
      PID:4772

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4772-133-0x0000026564980000-0x0000026564A80000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/4772-134-0x0000026564A80000-0x0000026564ACA000-memory.dmp
      Filesize

      296KB

      Download
    • memory/4772-135-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-136-0x0000026564A80000-0x0000026564ACA000-memory.dmp
      Filesize

      296KB

      Download
    • memory/4772-137-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-138-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-139-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-140-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-141-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-142-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-143-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-144-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-145-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-146-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-147-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-148-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/4772-149-0x0000000000BE0000-0x0000000000E44000-memory.dmp
      Filesize

      2.4MB

      Download