Analysis
-
max time kernel
168s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2023 02:43
Behavioral task
behavioral1
Sample
360hbtheme.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
360hbtheme.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
360hbtheme.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
360hbtheme.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
360hbthemeOrg.dll
Resource
win7-20231023-en
Behavioral task
behavioral6
Sample
360hbthemeOrg.dll
Resource
win10v2004-20231020-en
General
-
Target
360hbtheme.exe
-
Size
221KB
-
MD5
343f45d0971313b045ed3d3ad4f88469
-
SHA1
a89c8460e7433270b02afc832680b5ba61dd9882
-
SHA256
880ddcd3677bbd1106592ff78ba0ecaf771ddb94c4a33a2b54fa047e42c79640
-
SHA512
6e2b6c49c0b3d15d87cc8b3af2cc935173aa0efc4866d3acaa58fa020f99e87de6011ffe41dc97ed24b2db2ec9e634e2e3cf39abd73fa2385b2bcbbd94f6cc9e
-
SSDEEP
3072:4A/0I3ZWwMcd+P8KdfKsM8x1aTKsgFPgAgXq/TRO1uBFygyjNgK1dADYFe:JpW3cd+P8Ois3Fj9trPygySK1XFe
Malware Config
Extracted
cobaltstrike
100000
http://47.92.31.78:80/socialapiVersion=1.1
-
access_type
512
-
host
47.92.31.78,/socialapiVersion=1.1
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAdSG9zdDogb2ZmaWNlY2RuLm1pY3Jvc29mdC5jb20AAAAKAAAAKVJlZmVyZXI6IGh0dHBzOi8vb2ZmaWNlY2RuLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAEZXRhZwAAAAcAAAABAAAADwAAAA0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
30000
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDNXFfUSnRiMrus01oooCz6LOvdmjEE+7t+6lWJPjRacCsjD36xkeHkaQzYHqBIcp+IjzNOQWAkZeqSKWsWAdUzYDFb4JxRk+REfYtFkqJdO6vJYr9HeSBbcvIVifI4mnpePP5LjtfV9x8AHu1EGqJVJ6LIkucf4QWdZlyxuV5pQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.657621248e+09
-
unknown2
AAAABAAAAAEAAAdZAAAAAgAAB/IAAAACAAAD+AAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/socialapiVersion=2.0&include_base=true
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.26
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
360hbtheme.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 360hbtheme.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
360hbtheme.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 360hbtheme.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 360hbtheme.exe -
Processes:
resource yara_rule behavioral4/memory/1268-0-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-1-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-3-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-2-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-4-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-5-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-9-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida behavioral4/memory/1268-21-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmp themida -
Processes:
360hbtheme.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 360hbtheme.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
360hbtheme.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" 360hbtheme.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs" 360hbtheme.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1268-0-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-1-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-3-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-2-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-4-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-5-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-6-0x000001789B420000-0x000001789B457000-memory.dmpFilesize
220KB
-
memory/1268-7-0x000001789B780000-0x000001789B7C1000-memory.dmpFilesize
260KB
-
memory/1268-8-0x000001789BB30000-0x000001789BB7F000-memory.dmpFilesize
316KB
-
memory/1268-9-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB
-
memory/1268-21-0x00007FFE8C2A0000-0x00007FFE8D4E2000-memory.dmpFilesize
18.3MB