Overview

overview

10

Static

static

3

e49cc0a15d...1f.exe

windows7-x64

10

e49cc0a15d...1f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2023 12:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e49cc0a15db021b76733ebe1b1ce71ad1ee02013ecd731c3d6085d0c6435a01f.exe

  • Size

    489KB

  • MD5

    c929dd6f4b327c686426786e257110f4

  • SHA1

    534ed6a0c139a949d428a52d60a4e999e1bff2de

  • SHA256

    e49cc0a15db021b76733ebe1b1ce71ad1ee02013ecd731c3d6085d0c6435a01f

  • SHA512

    7e32a066e6ac7ab688c37b361d04920cd2fdf13f9089ca78afbce6d28266f93ee4346db54c65be13c0534928c44545834e31a43bad851055c3d7b8e4d40c1034

  • SSDEEP

    6144:ilwlmvO4mLYgZ0hVCwlsFQrD20LSCViY7xzBiMf2xOdFtUqylFcEkhWzTwfSv8mx:ilwgcYU0Gwls2O0Zff2wypuMMP

Score
10/10
cobaltstrike20410727backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

20410727

C2

http://service-2fhc3nsz-1319935181.bj.apigw.tencentcs.com:443/api/x

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    service-2fhc3nsz-1319935181.bj.apigw.tencentcs.com,/api/x

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAJSlNFU1NJT049AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    12800

  • polling_time

    30000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTWV74mUQ+mRv5G12a9zODYqH4hd3vN8wA5KM1K3qxHkx8PMfWuxuzFPJTbTmmP/psUSaIxASMDmgFAenz3/yOWa2GZRhGhYsxPzqZ3I9pFkF+QUzwhc8fWqWwOJv66NmlHQGJLc2kG3H4GT15QDwwz2TZ8NVMfeDzPuVcpJGwCwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.481970944e+09

  • unknown2

    AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /api/y

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3; .NET CLR 3.1.40767; Trident/6.0; en-IN)

  • watermark

    20410727

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e49cc0a15db021b76733ebe1b1ce71ad1ee02013ecd731c3d6085d0c6435a01f.exe
    "C:\Users\Admin\AppData\Local\Temp\e49cc0a15db021b76733ebe1b1ce71ad1ee02013ecd731c3d6085d0c6435a01f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4744-133-0x0000000000C00000-0x0000000000C84000-memory.dmp
    Filesize

    528KB

    Download
  • memory/4744-134-0x0000000001D20000-0x0000000001D61000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4744-135-0x0000000001D70000-0x0000000001DBE000-memory.dmp
    Filesize

    312KB

    Download
  • memory/4744-136-0x0000000001000000-0x00000000010BE000-memory.dmp
    Filesize

    760KB

    Download
  • memory/4744-137-0x0000000001220000-0x00000000014E9000-memory.dmp
    Filesize

    2.8MB

    Download
  • memory/4744-138-0x00000000015C0000-0x0000000001650000-memory.dmp
    Filesize

    576KB

    Download
  • memory/4744-139-0x0000000001750000-0x00000000017FC000-memory.dmp
    Filesize

    688KB

    Download
  • memory/4744-140-0x0000000001800000-0x000000000189E000-memory.dmp
    Filesize

    632KB

    Download
  • memory/4744-141-0x00000000019A0000-0x0000000001A3B000-memory.dmp
    Filesize

    620KB

    Download
  • memory/4744-142-0x0000000001A40000-0x0000000001B6A000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/4744-143-0x0000000001BB0000-0x0000000001BE1000-memory.dmp
    Filesize

    196KB

    Download
  • memory/4744-144-0x0000000001DC0000-0x0000000002290000-memory.dmp
    Filesize

    4.8MB

    Download
  • memory/4744-145-0x0000000002290000-0x00000000022FB000-memory.dmp
    Filesize

    428KB

    Download
  • memory/4744-147-0x0000000002520000-0x0000000002554000-memory.dmp
    Filesize

    208KB

    Download
  • memory/4744-148-0x0000000002560000-0x0000000002587000-memory.dmp
    Filesize

    156KB

    Download
  • memory/4744-151-0x0000000002970000-0x00000000029DA000-memory.dmp
    Filesize

    424KB

    Download
  • memory/4744-150-0x00000000028E0000-0x0000000002963000-memory.dmp
    Filesize

    524KB

    Download
  • memory/4744-149-0x00000000028D0000-0x00000000028DC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/4744-146-0x0000000001BF0000-0x0000000001C08000-memory.dmp
    Filesize

    96KB

    Download
  • memory/4744-152-0x00000000029E0000-0x0000000002C90000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/4744-153-0x0000000002C90000-0x0000000002FE5000-memory.dmp
    Filesize

    3.3MB

    Download
  • memory/4744-155-0x00000000030A0000-0x00000000031A0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/4744-154-0x0000000002FF0000-0x000000000309D000-memory.dmp
    Filesize

    692KB

    Download
  • memory/4744-156-0x00000000031A0000-0x0000000003341000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4744-157-0x0000000003350000-0x0000000003372000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4744-159-0x00000000033B0000-0x00000000034BB000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4744-158-0x0000000003380000-0x00000000033AB000-memory.dmp
    Filesize

    172KB

    Download
  • memory/4744-160-0x00000000034C0000-0x000000000355D000-memory.dmp
    Filesize

    628KB

    Download
  • memory/4744-161-0x0000000003770000-0x00000000037A0000-memory.dmp
    Filesize

    192KB

    Download
  • memory/4744-162-0x0000000004D40000-0x00000000054D0000-memory.dmp
    Filesize

    7.6MB

    Download
  • memory/4744-163-0x00000000054D0000-0x00000000054FC000-memory.dmp
    Filesize

    176KB

    Download
  • memory/4744-164-0x0000000005510000-0x0000000005565000-memory.dmp
    Filesize

    340KB

    Download
  • memory/4744-166-0x0000000005590000-0x00000000055A2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/4744-165-0x0000000005570000-0x000000000558F000-memory.dmp
    Filesize

    124KB

    Download
  • memory/4744-167-0x00000000058C0000-0x0000000005969000-memory.dmp
    Filesize

    676KB

    Download
  • memory/4744-168-0x0000000005AB0000-0x0000000005AC7000-memory.dmp
    Filesize

    92KB

    Download
  • memory/4744-170-0x0000000005DF0000-0x0000000005E2B000-memory.dmp
    Filesize

    236KB

    Download
  • memory/4744-169-0x0000000005AD0000-0x0000000005BD8000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4744-171-0x0000000005E30000-0x0000000005E3B000-memory.dmp
    Filesize

    44KB

    Download
  • memory/4744-172-0x0000000005E40000-0x0000000005E48000-memory.dmp
    Filesize

    32KB

    Download
  • memory/4744-173-0x0000000005E60000-0x000000000604B000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/4744-175-0x0000000006050000-0x0000000006078000-memory.dmp
    Filesize

    160KB

    Download
  • memory/4744-176-0x00000000060A0000-0x000000000616D000-memory.dmp
    Filesize

    820KB

    Download
  • memory/4744-174-0x0000000006080000-0x000000000608C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/4744-177-0x0000000006170000-0x000000000623C000-memory.dmp
    Filesize

    816KB

    Download
  • memory/4744-178-0x0000000006240000-0x000000000624A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/4744-179-0x0000000006250000-0x00000000062CF000-memory.dmp
    Filesize

    508KB

    Download
  • memory/4744-180-0x00000000062E0000-0x0000000006371000-memory.dmp
    Filesize

    580KB

    Download
  • memory/4744-182-0x00000000063B0000-0x00000000063EB000-memory.dmp
    Filesize

    236KB

    Download
  • memory/4744-185-0x0000000006570000-0x000000000657A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/4744-183-0x00000000063F0000-0x0000000006546000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/4744-181-0x0000000006390000-0x00000000063A5000-memory.dmp
    Filesize

    84KB

    Download
  • memory/4744-184-0x0000000006550000-0x0000000006562000-memory.dmp
    Filesize

    72KB

    Download
  • memory/4744-186-0x0000000006580000-0x00000000065E0000-memory.dmp
    Filesize

    384KB

    Download
  • memory/4744-187-0x00000000066E0000-0x0000000006707000-memory.dmp
    Filesize

    156KB

    Download
  • memory/4744-188-0x0000000006710000-0x0000000006736000-memory.dmp
    Filesize

    152KB

    Download
  • memory/4744-189-0x0000000001D70000-0x0000000001DBE000-memory.dmp
    Filesize

    312KB

    Download