General
-
Target
c3709d227b8cc1c698368187637c09290f1a952657f8e3292771c6ac8f8885bd.exe
-
Size
19KB
-
Sample
240105-n6jeqacdg4
-
MD5
4b078557e7754352515979f5af50ac42
-
SHA1
0f38083a45b2cd1716866ce9298e02d365cb016e
-
SHA256
c3709d227b8cc1c698368187637c09290f1a952657f8e3292771c6ac8f8885bd
-
SHA512
f04fb58c477937bd930d6a35ca23acb9b8e959ce120a126c16cac78b07269c677d39ab18462a79eef9f53099b99d3a95c0014fb2fccd1eb688708bc6743cafcb
-
SSDEEP
192:hV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2BC5dBIkvWF8qa1Dojjgi:zqaCF31cix+Dc4zjECVIFFF46gi
Static task
static1
Behavioral task
behavioral1
Sample
c3709d227b8cc1c698368187637c09290f1a952657f8e3292771c6ac8f8885bd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c3709d227b8cc1c698368187637c09290f1a952657f8e3292771c6ac8f8885bd.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
cobaltstrike
http://45.61.162.107:9999/UxHH
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)
Extracted
cobaltstrike
391144938
http://45.61.162.107:9999/fwlink
-
access_type
512
-
host
45.61.162.107,/fwlink
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9999
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCKjXP61eqGOfkws6p8nh4MdJUMgO70q6W+9/WpA/2CDF7jLGNjh0JwheMdfv06yNaw0vArT5LV3VsYXIfjVS4CJynrueDlm+RpYhOAX1AO7vNb+CCxgdgdPY5z8XwgBB5WBuKYlzpFu2Wjaq+11gDMXTUDXQunZPs23+tM9jBnVQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LEN2)
-
watermark
391144938
Targets
-
-
Target
c3709d227b8cc1c698368187637c09290f1a952657f8e3292771c6ac8f8885bd.exe
-
Size
19KB
-
MD5
4b078557e7754352515979f5af50ac42
-
SHA1
0f38083a45b2cd1716866ce9298e02d365cb016e
-
SHA256
c3709d227b8cc1c698368187637c09290f1a952657f8e3292771c6ac8f8885bd
-
SHA512
f04fb58c477937bd930d6a35ca23acb9b8e959ce120a126c16cac78b07269c677d39ab18462a79eef9f53099b99d3a95c0014fb2fccd1eb688708bc6743cafcb
-
SSDEEP
192:hV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2BC5dBIkvWF8qa1Dojjgi:zqaCF31cix+Dc4zjECVIFFF46gi
Score10/10 -