Overview

overview

10

Static

static

3

NEAS.0bc20...JC.exe

windows7-x64

10

NEAS.0bc20...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 17:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.0bc20c94b652a770124ec84d040782d0_JC.exe

  • Size

    281KB

  • MD5

    0bc20c94b652a770124ec84d040782d0

  • SHA1

    295aff07867a857a0355ffe7a5d5879c7db6d584

  • SHA256

    265f487f5e29c6c272b12294ad9a509cf2154f6cf6fe89793e0dd73a95ca33a6

  • SHA512

    58401aefbd0bcc354dec857895aa4f357833bc76fb1e93ab289fb3ea85d7d4e1c2f5baef35f41588ab04a2cd677a06b0fc9f43b54c93a876972a3052c9172cdc

  • SSDEEP

    6144:FCwxtXDFYk/fF0nvQXhsexsWD8yHAo5rATAzkb825KzLUU+:/XDFYYFCUhDxN8Po5rATeR25SU

Score
10/10
cobaltstrike0100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://dns.dddumpling.xyz:53/cx

Attributes
  • access_type

    512

  • beacon_type

    256

  • host

    dns.dddumpling.xyz,/cx

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    53

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCh70BlD6Tt5SLsqlLB4SOVblXCOkmUHz7sjazg9EdPKaGvKw8SbffZfGijQRMpErRkqVca3JaaBDzDDwIQL6irMaFjjgClTWOASuAbaDR8p2pI1ck29uVrX0qDQa2uEaAhWX1zsUODyekxkm/C4BEw5wcbk+Y1hWJ5FVCoxC4p4QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • watermark

    100000

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.0bc20c94b652a770124ec84d040782d0_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.0bc20c94b652a770124ec84d040782d0_JC.exe"
    1⤵
      PID:1672

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1672-0-0x0000000000650000-0x0000000000691000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1672-1-0x00000000006A0000-0x00000000006EF000-memory.dmp

      Filesize

      316KB

      Download

    • memory/1672-2-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

      Download

    • memory/1672-3-0x00000000006A0000-0x00000000006EF000-memory.dmp

      Filesize

      316KB

      Download