Overview

overview

10

Static

static

3

43e286c8e0...ad.dll

windows7-x64

10

43e286c8e0...ad.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2023 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    43e286c8e051f308a7e1f85c2a5f68e623a55d86b39cab01d3abcc0e74a629ad.dll

  • Size

    464KB

  • MD5

    c3d75e2fa447502714f41e5e5f59e41c

  • SHA1

    c0841ce59d8dcf78b8b7f8fdfc613b3c9053a076

  • SHA256

    43e286c8e051f308a7e1f85c2a5f68e623a55d86b39cab01d3abcc0e74a629ad

  • SHA512

    341561a7f335cdfbd45404267189e79121be3f5fd2bac067cdd3c163e0e3046e80e88899dbd8b07be3771446516afdaf1155f45480141f1b6aa007910d0136a8

  • SSDEEP

    12288:M+JPL6Cel4ObDPFXmhRDFEZ4lnwpKk+Jfsh:dJP6uObJWhxFEZ4lnwAk0sh

Score
10/10
cobaltstrike1234567890backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

C2

http://38.54.81.4:443/Gateway_helps

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    38.54.81.4,/Gateway_helps

  • http_header1

    AAAAEAAAABBIb3N0OiAzOC41NC44MS40AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAZQWNjZXB0LUVuY29kaW5nOiBnemlwLCBicgAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAcAAAAAAAAACAAAAAMAAAACAAAAK3dvcmRwcmVzc19kNmMwNDA1ZTBkN2FiMThmZDRlNmEwYjc0ZmNlNDBiMD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABBIb3N0OiAzOC41NC44MS40AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAoAAAAYQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluAAAABwAAAAEAAAADAAAAAwAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9984

  • polling_time

    56245

  • port_number

    443

  • sc_process32

    %windir%\syswow64\runonce.exe

  • sc_process64

    %windir%\sysnative\runonce.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDb2d1Pft3yev9PNANTXtA2HrkfVqRKNqhi/XQBq0Y/X1lP3rXcEYZbQ0mzVuGIhWKyXWg9suCj3IFVgwGOZvDcKxJCpmYun+j4PdNiscibrvHdtDZrtcOs+9N3AZF6WZifEm4W7unZBNd8rP6HSg4SeHhS7cobwXxkCdwfOjaJpQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    2.477861376e+09

  • unknown2

    AAAABAAAAAIAAAbnAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /network_connect

  • user_agent

    Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202

  • watermark

    1234567890

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Blocklisted process makes network request 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\43e286c8e051f308a7e1f85c2a5f68e623a55d86b39cab01d3abcc0e74a629ad.dll,#1
    1⤵
    • Blocklisted process makes network request
    PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2304-0-0x00000000001A0000-0x00000000001E8000-memory.dmp
    Filesize

    288KB

    Download
  • memory/2304-1-0x0000000001EB0000-0x0000000001F34000-memory.dmp
    Filesize

    528KB

    Download
  • memory/2304-2-0x0000000001EB0000-0x0000000001F34000-memory.dmp
    Filesize

    528KB

    Download