Malware Analysis Report

2024-08-06 11:04

Sample ID 240112-qgf96shch4
Target AliyunScan.exe
SHA256 c1898219b1796112547649fa7c1b623fb8fdac78b17860175ddd504960de80f5
Tags
cobaltstrike 100000000 backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1898219b1796112547649fa7c1b623fb8fdac78b17860175ddd504960de80f5

Threat Level: Known bad

The file AliyunScan.exe was found to be: Known bad.

Malicious Activity Summary

cobaltstrike 100000000 backdoor trojan

Cobaltstrike

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-01-12 13:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-12 13:13

Reported

2024-01-12 13:16

Platform

win7-20231129-en

Max time kernel

141s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 2908 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 2908 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 2864 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe
PID 2864 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe
PID 2864 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe
PID 2864 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\system32\calc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Windows\system32\calc.exe

calc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 update.chrome-update.net udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 www.microsoft.com udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
JP 167.179.97.219:2083 update.chrome-update.net tcp
JP 167.179.97.219:2083 update.chrome-update.net tcp

Files

memory/2864-2-0x000000013F2D0000-0x000000013F39E000-memory.dmp

memory/2924-3-0x0000000000060000-0x0000000000061000-memory.dmp

memory/2908-1-0x000000013F2D0000-0x000000013F39E000-memory.dmp

memory/2924-18-0x0000000003730000-0x0000000003BA2000-memory.dmp

memory/2908-19-0x000000013F2D0000-0x000000013F39E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\Tar84DE.tmp

MD5 71e4ce8b3a1b89f335a6936bbdafce4c
SHA1 6e0d450eb5f316a9924b3e58445b26bfb727001e
SHA256 a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5
SHA512 b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-12 13:13

Reported

2024-01-12 13:16

Platform

win10v2004-20231222-en

Max time kernel

149s

Max time network

151s

Command Line

calc.exe

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 740 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 740 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe
PID 508 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\SYSTEM32\calc.exe
PID 508 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\SYSTEM32\calc.exe
PID 508 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe C:\Windows\SYSTEM32\calc.exe

Processes

C:\Windows\SYSTEM32\calc.exe

calc.exe

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe

"C:\Users\Admin\AppData\Local\Temp\AliyunScan.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 21.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 update.chrome-update.net udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 219.97.179.167.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
JP 167.179.97.219:2083 update.chrome-update.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
JP 167.179.97.219:2083 update.chrome-update.net tcp

Files

memory/740-3-0x00007FF7C9300000-0x00007FF7C93CE000-memory.dmp

memory/508-4-0x00007FF7C9300000-0x00007FF7C93CE000-memory.dmp

memory/3700-5-0x000002908FBF0000-0x0000029090062000-memory.dmp

memory/3700-6-0x000002908F7F0000-0x000002908F948000-memory.dmp

memory/740-9-0x00007FF7C9300000-0x00007FF7C93CE000-memory.dmp

memory/3700-11-0x000002908F7F0000-0x000002908F948000-memory.dmp