Analysis
- max time kernel
184s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
01/11/2023, 03:33
General
- Target b18d30eaa9079143b6d69dc7fb54d6cb0834284a3b873cfdf1fa08870e454ee1.exe
- Size 13.5MB
- Sample231101-d4jmlabg92
- SHA256 b18d30eaa9079143b6d69dc7fb54d6cb0834284a3b873cfdf1fa08870e454ee1
Malware Config
Extracted
-
cobaltstrike
-
1
-
http://192.168.6.77:6671/broadcast
-
beacon_type
2048
-
host
192.168.6.77,/broadcast
-
http_header1
AAAACgAAAClBY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24sIHRleHQvcGxhaW4sICovKgAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeT3JpZ2luOiBodHRwczovL3d3dy5hbWF6b24uY29tAAAACgAAAB9SZWZlcmVyOiBodHRwczovL3d3dy5hbWF6b24uY29tAAAACgAAABVTZWMtRmV0Y2gtRGVzdDogZW1wdHkAAAAKAAAAFFNlYy1GZXRjaC1Nb2RlOiBjb3JzAAAACgAAABpTZWMtRmV0Y2gtU2l0ZTogY3Jvc3Mtc2l0ZQAAAAoAAAAMVGU6IHRyYWlsZXJzAAAABwAAAAAAAAADAAAABgAAABB4LWFtem4tUmVxdWVzdElkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAeT3JpZ2luOiBodHRwczovL3d3dy5hbWF6b24uY29tAAAABwAAAAEAAAANAAAAAgAAAPR7ImV2ZW50cyI6W3siZGF0YSI6eyJzY2hlbWFJZCI6ImNzYS5WaWRlb0ludGVyYWN0aW9ucy4xIiwiYXBwbGljYXRpb24iOiJSZXRhaWw6UHJvZDosInJlcXVlc3RJZCI6Ik1CRlY4MlRUUVYySk5CS0pKNTBCIiwidGl0bGUiOiJBbWF6b24uY29tLiBTcGVuZCBsZXNzLiBTbWlsZSBtb3JlLiIsInN1YlBhZ2VUeXBlIjoiZGVza3RvcCIsInNlc3Npb24iOnsiaWQiOiIxMzMtOTkwNTA1NS0yNjc3MjY2In0sInZpZGVvIjp7ImlkIjoiAAAAAQAAAAIiCgAAAAEAAAB1InBsYXllck1vZGUiOiJJTkxJTkUiLCJ2aWRlb1JlcXVlc3RJZCI6Ik1CRlY4MlRUUVYySk5CS0pKNTBCIiwiaXNBdWRpb09uIjoiZmFsc2UiLCJwbGF5ZXIiOiJJVlMiLCJldmVudCI6Ik5PTkUifX19fV19AAAABAAAAAcAAAAAAAAADQAAAAYAAAAJeC1hbXotcmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
6912
-
polling_time
38500
-
port_number
6671
-
sc_process32
%windir%\syswow64\gpupdate.exe
-
sc_process64
%windir%\sysnative\gpupdate.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCARGR8Ysub0ue40rgzjyAK8mYwYOGgbuMowVdXFAiT9ffvBXi8NJ086mgdl+XRxWxFIw1r5a27Bh+Z2CdkoIBJ+P2temzw5ZDEPVV42LQeAzkCDQucoXiR4MLm/eFps2pVIgM2vZi8DWnXt+7YmOkWlML0JfoJatB39tvR0wE3twIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
9.28716032e+08
-
unknown2
AAAABAAAAAEAAAUcAAAAAQAAAAEAAAACAAAAwgAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/1/events/com.amazon.csm.csa.prod
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
-
watermark
1
Extracted
-
cobaltstrike
-
0
-
watermark
0
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b18d30eaa9079143b6d69dc7fb54d6cb0834284a3b873cfdf1fa08870e454ee1.exe"C:\Users\Admin\AppData\Local\Temp\b18d30eaa9079143b6d69dc7fb54d6cb0834284a3b873cfdf1fa08870e454ee1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2228-0-0x00007FFD8BE10000-0x00007FFD8BE12000-memory.dmp
memory/2228-2-0x00007FF711DE0000-0x00007FF71338D000-memory.dmp
memory/2228-1-0x00007FF711DE0000-0x00007FF71338D000-memory.dmp
memory/2228-4-0x00007FFD89F80000-0x00007FFD8A03E000-memory.dmp
memory/2228-5-0x000002195AF50000-0x000002195B050000-memory.dmp
memory/2228-6-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp
memory/2228-7-0x00007FF711DE0000-0x00007FF71338D000-memory.dmp
memory/2228-8-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp
memory/2228-9-0x00007FFD89F80000-0x00007FFD8A03E000-memory.dmp
memory/2228-10-0x000002195AF50000-0x000002195B050000-memory.dmp
memory/2228-12-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp
memory/2228-15-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp
memory/2228-17-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp
memory/2228-21-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp
memory/2228-23-0x00007FFD6DF20000-0x00007FFD6DFAD000-memory.dmp