Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
22-10-2023 08:33
General
-
Target
8746d733e37d074cdc837cdc2b8094a59dadb8eaa9874e5e4c56ff545145992c.exe
-
Size
121KB
-
MD5
0405ba9a4b0b09646bccd07953c0f9c2
-
SHA1
06f7a3f2ca8bc13109169fbbe63ae3b798695cd1
-
SHA256
8746d733e37d074cdc837cdc2b8094a59dadb8eaa9874e5e4c56ff545145992c
-
SHA512
f00c5b867df7b8482589959a100dcc0179f280618f9e88cb9adbcd54e1782d3b32de0d4ef953626c3606694d299068b17e90da3adfb150f6ad481c1e7c091ff0
-
SSDEEP
3072:TDXGBuC6N6FvPNrD8Z2Fr1UHUva2JEXDFoku7XxDui8:TLlN2vPNrWvXZo/Dui8
Malware Config
Extracted
cobaltstrike
http://101.43.12.111:9999/kAZW
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)
Extracted
cobaltstrike
1873433027
http://101.43.12.111:9999/ga.js
-
access_type
512
-
host
101.43.12.111,/ga.js
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
9999
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCK3j1QiFPITUraY40sh00GqcwT6dYusp8JQ0Tm9arCWRgbjdY1s3MmZ8jz2c6gS5PUWLPhn5TgqRdD+YSw4m7AvYpWDGHufmWRflYFKTZDr9G+BhHyW3w5TZwnVHmxYfsKN5V8tLfd5u7DeNYHSREKaZeIQDBu97WefxyKwdmJIwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)
-
watermark
1873433027
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8746d733e37d074cdc837cdc2b8094a59dadb8eaa9874e5e4c56ff545145992c.exe"C:\Users\Admin\AppData\Local\Temp\8746d733e37d074cdc837cdc2b8094a59dadb8eaa9874e5e4c56ff545145992c.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.0MB
-
Filesize
340KB
-
Filesize
152KB
-
Filesize
340KB
-
Filesize
152KB