Malware Analysis Report

2024-08-06 11:03

Sample ID 240112-pw6ypsgacq
Target AliyunScan.exe
SHA256 c1898219b1796112547649fa7c1b623fb8fdac78b17860175ddd504960de80f5
Tags
cobaltstrike 100000000 backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1898219b1796112547649fa7c1b623fb8fdac78b17860175ddd504960de80f5

Threat Level: Known bad

The file AliyunScan.exe was found to be: Known bad.

Malicious Activity Summary

cobaltstrike 100000000 backdoor trojan

Cobaltstrike

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-01-12 12:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-12 12:41

Reported

2024-01-12 12:44

Platform

win7-20231215-en

Max time kernel

142s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 2184 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 2184 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 2296 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe
PID 2296 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe
PID 2296 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe
PID 2296 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Windows\system32\calc.exe

calc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 update.chrome-update.net udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
JP 167.179.97.219:2083 update.chrome-update.net tcp
JP 167.179.97.219:2083 update.chrome-update.net tcp
JP 167.179.97.219:2083 update.chrome-update.net tcp

Files

memory/2184-1-0x000000013F7E0000-0x000000013F8AE000-memory.dmp

memory/2296-2-0x000000013F7E0000-0x000000013F8AE000-memory.dmp

memory/2468-3-0x0000000000060000-0x0000000000061000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabA095.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/2468-20-0x0000000003500000-0x0000000003972000-memory.dmp

memory/2468-21-0x0000000003100000-0x0000000003500000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarD416.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

memory/2184-42-0x000000013F7E0000-0x000000013F8AE000-memory.dmp

memory/2468-45-0x0000000003100000-0x0000000003500000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-12 12:41

Reported

2024-01-12 12:44

Platform

win10v2004-20231215-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3488 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 3488 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 4772 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\SYSTEM32\calc.exe
PID 4772 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\SYSTEM32\calc.exe
PID 4772 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\SYSTEM32\calc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Windows\SYSTEM32\calc.exe

calc.exe

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 update.chrome-update.net udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 219.97.179.167.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp

Files

memory/3488-1-0x00007FF70CEE0000-0x00007FF70CFAE000-memory.dmp

memory/4772-2-0x00007FF70CEE0000-0x00007FF70CFAE000-memory.dmp

memory/3688-5-0x0000015B42810000-0x0000015B42C82000-memory.dmp

memory/3688-6-0x0000015B42410000-0x0000015B42810000-memory.dmp

memory/3488-9-0x00007FF70CEE0000-0x00007FF70CFAE000-memory.dmp

memory/3688-11-0x0000015B42410000-0x0000015B42810000-memory.dmp