Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2023 17:16
Static task
static1
Behavioral task
behavioral1
Sample
92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31.dll
Resource
win10v2004-20230915-en
General
-
Target
92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31.dll
-
Size
482KB
-
MD5
57e4ef873693892da6c20512fefb6dff
-
SHA1
5ce485c9739bd2f82175d557444fd0f5f00646a7
-
SHA256
92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31
-
SHA512
2973b8ae186ec0e5652cd5f2ee79b8cb4d05c1f56df4c22dbeb7fb81b4aab72fc2ab3a0bc757bca71a8e095ce4aa28ff0c60a8b09247464f7487eb2199b7821a
-
SSDEEP
12288:65hlJthDY7hlPJMFN8hbAvNQPjapvZZSGGBwdY5H:65hlJthDY7XPSFN8JcNi+pvfSz5
Malware Config
Extracted
cobaltstrike
100000
http://bowepavij.info:443/btn_bg
-
access_type
512
-
beacon_type
2048
-
host
bowepavij.info,/btn_bg
-
http_header1
AAAAEAAAAA9Ib3N0OiBnb29nbGUucnUAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAAD1BY2NlcHQtTGFuZ3VhZ2U6IGZyLUNILCBmcjtxPTAuOSwgZW47cT0wLjgsIGRlO3E9MC43LCAqO3E9MC41AAAABwAAAAAAAAALAAAAAwAAAAIAAAADbHU9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAAA9Ib3N0OiBnb29nbGUucnUAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAABhDb250ZW50LVR5cGU6IHRleHQvcGxhaW4AAAAHAAAAAQAAAA8AAAADAAAABAAAAAcAAAAAAAAAAwAAAAIAAAAOX19zZXNzaW9uX19pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
10752
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMTYdvf09eP+DWxCNxtLIWjz/eRGlVf086n5ht8JeLfg24m94hqRQAMUdpPg7hF6xpkBp2vF+sXoitt4gdauXiuor5mHok6qS3E4uFD8+icdqEJUm1Midbkh98WKLs/OEjfTiPwjTWVGOteXfZdcxQBvzudR+S9bW3Oa+1A7h6VwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.43751424e+08
-
unknown2
AAAABAAAAAIAAAFSAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/ku
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; HTC One X10 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 4752 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 4752 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4752-0-0x00000253DBC30000-0x00000253DBC98000-memory.dmpFilesize
416KB
-
memory/4752-1-0x00000253DBCA0000-0x00000253DBD2A000-memory.dmpFilesize
552KB
-
memory/4752-2-0x00007FFE54800000-0x00007FFE54885000-memory.dmpFilesize
532KB
-
memory/4752-3-0x00000253DBC30000-0x00000253DBC98000-memory.dmpFilesize
416KB