Overview

overview

10

Static

static

7

360hbtheme...me.dll

windows7-x64

9

360hbtheme...me.dll

windows10-2004-x64

9

360hbtheme...me.exe

windows7-x64

9

360hbtheme...me.exe

windows10-2004-x64

10

360hbtheme...rg.dll

windows7-x64

1

360hbtheme...rg.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    167s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-11-2023 08:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    360hbtheme/360hbtheme.exe

  • Size

    221KB

  • MD5

    343f45d0971313b045ed3d3ad4f88469

  • SHA1

    a89c8460e7433270b02afc832680b5ba61dd9882

  • SHA256

    880ddcd3677bbd1106592ff78ba0ecaf771ddb94c4a33a2b54fa047e42c79640

  • SHA512

    6e2b6c49c0b3d15d87cc8b3af2cc935173aa0efc4866d3acaa58fa020f99e87de6011ffe41dc97ed24b2db2ec9e634e2e3cf39abd73fa2385b2bcbbd94f6cc9e

  • SSDEEP

    3072:4A/0I3ZWwMcd+P8KdfKsM8x1aTKsgFPgAgXq/TRO1uBFygyjNgK1dADYFe:JpW3cd+P8Ois3Fj9trPygySK1XFe

Score
10/10
cobaltstrike100000backdoorevasionthemidatrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://47.92.31.78:80/socialapiVersion=1.1

Attributes
  • access_type

    512

  • host

    47.92.31.78,/socialapiVersion=1.1

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAdSG9zdDogb2ZmaWNlY2RuLm1pY3Jvc29mdC5jb20AAAAKAAAAKVJlZmVyZXI6IGh0dHBzOi8vb2ZmaWNlY2RuLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAEZXRhZwAAAAcAAAABAAAADwAAAA0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    30000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\runonce.exe

  • sc_process64

    %windir%\sysnative\runonce.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDNXFfUSnRiMrus01oooCz6LOvdmjEE+7t+6lWJPjRacCsjD36xkeHkaQzYHqBIcp+IjzNOQWAkZeqSKWsWAdUzYDFb4JxRk+REfYtFkqJdO6vJYr9HeSBbcvIVifI4mnpePP5LjtfV9x8AHu1EGqJVJ6LIkucf4QWdZlyxuV5pQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    2.657621248e+09

  • unknown2

    AAAABAAAAAEAAAdZAAAAAgAAB/IAAAACAAAD+AAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /socialapiVersion=2.0&include_base=true

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.26

  • watermark

    100000

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\360hbtheme\360hbtheme.exe
    "C:\Users\Admin\AppData\Local\Temp\360hbtheme\360hbtheme.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Modifies registry class
    PID:4760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4760-0-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-1-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-2-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-3-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-4-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-5-0x0000028C31D00000-0x0000028C31D37000-memory.dmp
    Filesize

    220KB

    Download
  • memory/4760-6-0x0000028C32370000-0x0000028C323B1000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4760-7-0x0000028C323C0000-0x0000028C3240F000-memory.dmp
    Filesize

    316KB

    Download
  • memory/4760-8-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-20-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/4760-21-0x00007FFAE25A0000-0x00007FFAE37E2000-memory.dmp
    Filesize

    18.3MB

    Download