Overview

overview

10

Static

static

3

求职材...ll.dll

windows7-x64

1

求职材...ll.dll

windows10-2004-x64

1

求职材...rt.exe

windows7-x64

10

求职材...rt.exe

windows10-2004-x64

10

求职材....pdf

windows7-x64

1

求职材....pdf

windows10-2004-x64

1

求职材....exe

windows7-x64

10

求职材....exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7597f8fe471d3b2efd251431e424c219d2eab873fde26113f29ad2bca94e041e

  • Size

    6.4MB

  • Sample

    231123-j2dapahd9v

  • MD5

    ad90bae5cc22cf50165c60d16d176cc2

  • SHA1

    3025aeab70eec4a84a4721d931bcd390385d01a4

  • SHA256

    7597f8fe471d3b2efd251431e424c219d2eab873fde26113f29ad2bca94e041e

  • SHA512

    2a1945506ecc6b5716311d8e150c0147e821cd47c68d89b874a6859187cf59c88071f15ad7f39c41f389ec6fde9127c1e73690be5a9dd89fbe6bb0a493be3000

  • SSDEEP

    196608:AYRp56TGxwAb2Flt2f2C69Szb0tvWQKQgCOc8qpBm3I:Aev0Gfwn2fv690yTxB/

Score
10/10
cobaltstrike01359593325backdoorlinkpdfpyinstallertrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://time.api.chinabm.cn:443/Rpc

Attributes
  • user_agent

    Host: time.api.chinabm.cn Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)

Extracted

Family

cobaltstrike

Botnet

1359593325

C2

http://time.api.chinabm.cn:443/owa/

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    time.api.chinabm.cn,/owa/

  • http_header1

    AAAAEAAAABZIb3N0OiBvdXRsb29rLmxpdmUuY29tAAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAACGQ29va2llOiBNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZD05NWMxOGQ4LTRkY2U5ODU0O0NsaWVudElkPTFDMEY2QzVEOTEwRjk7TVNQQXV0aD0zRWtBakRLakk7eGlkPTczMGJmNzt3bGE0Mj1aRzB5TXpBMktqRXMAAAAHAAAAAAAAAA0AAAAFAAAAAndhAAAACQAAAA5wYXRoPS9jYWxlbmRhcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABZIb3N0OiBvdXRsb29rLmxpdmUuY29tAAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAABAAAADQAAAAUAAAACd2EAAAAHAAAAAAAAAA0AAAACAAAABndsYTQyPQAAAAIAAAALeGlkPTczMGJmNzsAAAACAAAAEk1TUEF1dGg9M0VrQWpES2pJOwAAAAIAAAAXQ2xpZW50SWQ9MUMwRjZDNUQ5MTBGOTsAAAACAAAAOE1pY3Jvc29mdEFwcGxpY2F0aW9uc1RlbGVtZXRyeURldmljZUlkPTk1YzE4ZDgtNGRjZTk4NTQ7AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • jitter

    5120

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgwZtr5WmRWGqXa6bxdqQDUmj+XU+vA4zK2b7Nfzq4qy143458ufxXidOMjoSLVP3BqyJgWamd0KYY7Yt3bDmFbWashi7f+OYdWpDNixd5AvcGOOzQhShEZ/0Uz8CG/gc99swyssnxs0YBg9Hka4Wh0ufxO89KSApuLegLE5i1/QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.448416512e+09

  • unknown2

    AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /OWA/

  • user_agent

    Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)

  • watermark

    1359593325

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Targets

    • Target

      求职材料/附件材料/RfSbieDll.dll

    • Size

      503KB

    • MD5

      ca34259469fe2de36d837b41c1273446

    • SHA1

      abb5d7194388cb81fd4edc7879c77cb5103dc266

    • SHA256

      2c76a3805c1086c72d9a79ad5a01b596845bf55603b0a6178c80a6dead5fe847

    • SHA512

      b9371039b7048a4bc1aefc308e03e3fb317dce7e782dc6dec676bab36ef81f8fdffb945b6f766d3470fda46a4fd9d8d2c4285814953f3dd171a4b183835a5e7b

    • SSDEEP

      12288:tXe8w4Tr5/P/ofvv4htLhVEeqQ4aAgD9kgsK:tX13p/UmVh6eqnazZkgsK

    Score
    1/10
    behavioral1behavioral2

    • Target

      求职材料/附件材料/Start.exe

    • Size

      456KB

    • MD5

      552b77913d6c90595e9c4d97e38ccf78

    • SHA1

      f26f738300206a19aa03cf8002cbd05dbd8d8fd7

    • SHA256

      9d45b2d1dfbadb2297ab551084edc1ef31f14f058ca894ea1b7ce4f77a36bfb3

    • SHA512

      f04e9e58dabee309364cd11e28fa8949613258a02fb668eb528f1023f68c0d5595da150b9b3cb1b713a06085eada5e4cdedbfdb6b3860aa634e1bc17a7f7dbb4

    • SSDEEP

      6144:UwXaUhoveNAlh/MUAirc+G5xgT/AXTw/ohz28R7spOswaATH:UwXaUhoWo+iEwod7+U/

    Score
    10/10
    cobaltstrike1359593325backdoortrojan0
    behavioral3behavioral4

    • Target

      求职材料/附件材料/教育部学籍在线验证报告.pdf

    • Size

      249KB

    • MD5

      8d42679d59b7fa6d1a9bb4804a1dd9a2

    • SHA1

      f5d1d4256847c07365d36279fbed193f47553a35

    • SHA256

      81d1caf160d9463dad0da24bd81361902b41487f69ae71234c0a81d50a315697

    • SHA512

      f99ce1ccfa6330bbbc8f9bc9c7188c43007c14b736ea8e0ad980c403371e46b724f4064fbd31add935515826dd24038df88eb3c045ef12b1c682515257e50308

    • SSDEEP

      6144:VcQaLMFECuwMROZMzyuooQBmqB4jkWqoDckQ7o:5RMwZdYjpqoDcTc

    Score
    1/10
    behavioral5behavioral6

    • Target

      求职材料/陈婷婷-中山大学-公共卫生学院流行病与卫生统计学硕士.exe

    • Size

      4.5MB

    • MD5

      85116c4438a948fbe220fac7af8a043f

    • SHA1

      544f5b24b492fcaf2bffab58f91192ed2885896b

    • SHA256

      5c7d3e1bd16255915f208ade347bd3a57aab67a81c2c9439df46e08ad10a0b1e

    • SHA512

      eda59ac75cee523e06442f4ceaa8d7327dafde0618f60e0bceaf1068c2e3d403ba4a19a18efe800144d8c6ae811db70b2231f8f5528914b4db5a76cfe444c8ec

    • SSDEEP

      98304:LZeHQcQki1LShsRT6q+LsnggYpdBs8R8YT6v/TwZVVEB2lFo3WcQe6bA:AwcQki1LShOOq+L7gYpx+YnEktBbA

    Score
    10/10
    cobaltstrike1359593325backdoortrojan0

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks