Overview

overview

10

Static

static

3

WTSAPI32.dll

windows7-x64

1

WTSAPI32.dll

windows10-2004-x64

1

music.exe

windows7-x64

4

music.exe

windows10-2004-x64

10

Resubmissions

17-01-2024 09:19

240117-laklssdcb4 3

26-12-2023 07:14

231226-h25t9sahdk 10

Analysis

  • max time kernel
    165s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 07:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    music.exe

  • Size

    1.4MB

  • MD5

    57c3a0543085a646c010beaabf16d0be

  • SHA1

    b8c0951241dc0e55c4bd73c5e2d33242bd683ff2

  • SHA256

    14436eaf182648ab89c9a54d2e83e5071c07c250e6c744a314035f9424a9106f

  • SHA512

    35e7b74ff0d07e1d392b6a88a3f4dfc2e1b2d77e8a9246621ad8bf15e41b8c4434a75bcf22d692e24f5450ce38b0440a7ccd749cc9d123a95487ce89cab298e8

  • SSDEEP

    12288:mKg1wFSd2zIucT9v+8CbdEujvqzVoZTZINv/GPwVOPc+62z77ei8M/TW0n/T+QN1:mISYzIuw90GkT6Nv/GPwVOE+6Gei8U

Score
10/10
cobaltstrike100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://www.hikunpeng.com:80/audiencemanager.js

Attributes
  • access_type

    512

  • host

    www.hikunpeng.com,/audiencemanager.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAaSG9zdDogc3RhdGljLm1pY3Jvc29mdC5jb20AAAAKAAAAJlJlZmVyZXI6IGh0dHBzOi8vc3RhdGljLm1pY3Jvc29mdC5jb20vAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAHAAAAAAAAAA0AAAACAAAACF9fbXMtY3Y9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAVSG9zdDogY2RuLmJvb3Rjc3MuY29tAAAACgAAACBSZWZlcmVyOiBodHRwOi8vY2RuLmJvb3Rjc3MuY29tLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAABQAAAAdfX21zLWN2AAAABwAAAAEAAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    30000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\runonce.exe

  • sc_process64

    %windir%\sysnative\runonce.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJKQv1XF4Cmh2xywEarCa/bP0HPP+UFEQJHMOo5NsyVYvAVfHd59D4LmvVhtB6dvdqdkLUunc6NQljbO4D42xMOrFI41rqlbFibjEJQYX58RbZvjS1bhHVKa9XdQIQRpuk3eWO4Pk+iGyM1gHKjyZT+PV5lhUp1aBwAUirc7UnEQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.435374848e+09

  • unknown2

    AAAABAAAAAEAAAf+AAAAAgAAIUwAAAACAAAPtQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /audiencemanager-v2.js

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36

  • watermark

    100000

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\music.exe
    "C:\Users\Admin\AppData\Local\Temp\music.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4984-0-0x0000000000980000-0x00000000009A2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4984-9-0x0000000000980000-0x00000000009A2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4984-10-0x0000000002220000-0x0000000002288000-memory.dmp
    Filesize

    416KB

    Download
  • memory/4984-19-0x0000000002220000-0x0000000002288000-memory.dmp
    Filesize

    416KB

    Download
  • memory/4984-20-0x00007FFD43140000-0x00007FFD43141000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4984-22-0x00007FFD43150000-0x00007FFD43151000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4984-21-0x00007FFDC3090000-0x00007FFDC3285000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4984-23-0x00007FFD43160000-0x00007FFD43161000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4984-24-0x00007FFD43170000-0x00007FFD43171000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4984-26-0x0000000048000000-0x000000004819F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4984-25-0x00000000481A0000-0x000000004833F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4984-39-0x00000000481A0000-0x000000004833F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4984-46-0x000000006F030000-0x000000006F07F000-memory.dmp
    Filesize

    316KB

    Download
  • memory/4984-48-0x000000006EF90000-0x000000006EFD1000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4984-47-0x000000006EFE0000-0x000000006F021000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4984-45-0x000000006F080000-0x000000006F0CF000-memory.dmp
    Filesize

    316KB

    Download
  • memory/4984-42-0x0000000048000000-0x000000004819F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4984-49-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-50-0x0000000000980000-0x00000000009A2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4984-51-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-52-0x0000000002220000-0x0000000002288000-memory.dmp
    Filesize

    416KB

    Download
  • memory/4984-53-0x00007FFDC3090000-0x00007FFDC3285000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4984-54-0x00000000481A0000-0x000000004833F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4984-55-0x0000000048000000-0x000000004819F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4984-56-0x000000006EFE0000-0x000000006F021000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4984-57-0x000000006EF90000-0x000000006EFD1000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4984-58-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-59-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-60-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-61-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-63-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-64-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-65-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-66-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-67-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-68-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-69-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download
  • memory/4984-70-0x000000006FE20000-0x00000000710E6000-memory.dmp
    Filesize

    18.8MB

    Download