Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 08:42
Static task
static1
Behavioral task
behavioral1
Sample
WTSAPI32.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WTSAPI32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
music.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
music.exe
Resource
win10v2004-20231215-en
General
-
Target
music.exe
-
Size
1.4MB
-
MD5
57c3a0543085a646c010beaabf16d0be
-
SHA1
b8c0951241dc0e55c4bd73c5e2d33242bd683ff2
-
SHA256
14436eaf182648ab89c9a54d2e83e5071c07c250e6c744a314035f9424a9106f
-
SHA512
35e7b74ff0d07e1d392b6a88a3f4dfc2e1b2d77e8a9246621ad8bf15e41b8c4434a75bcf22d692e24f5450ce38b0440a7ccd749cc9d123a95487ce89cab298e8
-
SSDEEP
12288:mKg1wFSd2zIucT9v+8CbdEujvqzVoZTZINv/GPwVOPc+62z77ei8M/TW0n/T+QN1:mISYzIuw90GkT6Nv/GPwVOE+6Gei8U
Malware Config
Extracted
cobaltstrike
100000
http://www.hikunpeng.com:80/audiencemanager.js
-
access_type
512
-
host
www.hikunpeng.com,/audiencemanager.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAaSG9zdDogc3RhdGljLm1pY3Jvc29mdC5jb20AAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vc3RhdGljLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAABQAAAAdfX21zLWN2AAAABwAAAAEAAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
30000
-
port_number
80
-
sc_process32
%windir%\syswow64\runonce.exe
-
sc_process64
%windir%\sysnative\runonce.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJKQv1XF4Cmh2xywEarCa/bP0HPP+UFEQJHMOo5NsyVYvAVfHd59D4LmvVhtB6dvdqdkLUunc6NQljbO4D42xMOrFI41rqlbFibjEJQYX58RbZvjS1bhHVKa9XdQIQRpuk3eWO4Pk+iGyM1gHKjyZT+PV5lhUp1aBwAUirc7UnEQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.435374848e+09
-
unknown2
AAAABAAAAAEAAAf+AAAAAgAAIUwAAAACAAAPtQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/audiencemanager-v2.js
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Drops file in Windows directory 1 IoCs
Processes:
music.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.app.log music.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
music.exepid process 3032 music.exe 3032 music.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3032-0-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/3032-7-0x0000000072470000-0x0000000073F55000-memory.dmpFilesize
26.9MB
-
memory/3032-10-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/3032-11-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-15-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-19-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-23-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-31-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-27-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-39-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-35-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-43-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-47-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-48-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-63-0x00000000747B0000-0x00000000747FF000-memory.dmpFilesize
316KB
-
memory/3032-66-0x0000000074AB0000-0x0000000074AFF000-memory.dmpFilesize
316KB
-
memory/3032-67-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-68-0x0000000074760000-0x00000000747A0000-memory.dmpFilesize
256KB
-
memory/3032-69-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-70-0x0000000074A60000-0x0000000074AA1000-memory.dmpFilesize
260KB
-
memory/3032-71-0x0000000072470000-0x0000000073F55000-memory.dmpFilesize
26.9MB
-
memory/3032-72-0x0000000048150000-0x00000000482EF000-memory.dmpFilesize
1.6MB
-
memory/3032-73-0x0000000047FB0000-0x000000004814F000-memory.dmpFilesize
1.6MB
-
memory/3032-74-0x0000000074A60000-0x0000000074AA1000-memory.dmpFilesize
260KB