Overview

overview

10

Static

static

3

ibtusb.exe

windows7-x64

10

ibtusb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 13:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ibtusb.exe

  • Size

    5.3MB

  • MD5

    44eba36e7384d8acfb71c45ecd76cd2f

  • SHA1

    478b267a1e24b0b89b95e34dd4f9e332cbe245e9

  • SHA256

    0f344424ed7746c3f41e07085d997fc94b3bff5ff4e3007a08400249218af79e

  • SHA512

    d2440215688ca2c41768f6bb0176d579a83379b36d55030a3ca9d9a78bf00d97cbf64216540b7bf1e43f06b8a848bd9bc48f0c97ef43d1ee6439ed85204c1ac5

  • SSDEEP

    98304:4Dnjjk9yqWaZNyRKKYw7ts9CvT5EDeKxW2aFlRpuI:SjjbaORbTps7wru

Score
10/10
cobaltstrike1580103824backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1580103824

C2

http://qw.regcssv.com:443/fam_calendar

http://as.regcssv.com:443/fam_calendar

http://zx.regcssv.com:443/fam_calendar
Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    qw.regcssv.com,/fam_calendar,as.regcssv.com,/fam_calendar,zx.regcssv.com,/fam_calendar

  • http_header1

    AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAAAwAAAAMAAAACAAAAK3dvcmRwcmVzc19lZDFmNjE3YmJkNmMwMDRjYzA5ZTA0NmYzYzFiNzE0OD0AAAAGAAAABkNvb2tpZQAAAAkAAAAJbWQ1PWZhbHNlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAlQWNjZXB0LUxhbmd1YWdlOiBlbi1HQjtxPTAuOSwgKjtxPTAuNwAAAAoAAAAYQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluAAAABwAAAAEAAAADAAAAAwAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9984

  • polling_time

    58745

  • port_number

    443

  • sc_process32

    %windir%\syswow64\WUAUCLT.exe

  • sc_process64

    %windir%\sysnative\WUAUCLT.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUb+e4qIKcYoI+Y1xKjMHzDQfGYWgzOb7mw+L70GWuQk4deptUnuenxtej6a430owXJvcyaF6I5k8YLIVEvAJMqaRG6TNs1jNxTVw8fiAKByNLheFZ/jG4kr7Lq2oS7z4YvGFuIVl4uCXUC91r+9CWmTq0//srllDPwNAFFGbmHwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.272630272e+09

  • unknown2

    AAAABAAAAAIAAAFSAAAAAwAAAAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /mt

  • user_agent

    Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)

  • watermark

    1580103824

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\ibtusb.exe
    "C:\Users\Admin\AppData\Local\Temp\ibtusb.exe"
    1⤵
      PID:2912

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2912-1-0x0000000002F90000-0x0000000003019000-memory.dmp
      Filesize

      548KB

      Download
    • memory/2912-0-0x0000000002890000-0x0000000002F90000-memory.dmp
      Filesize

      7.0MB

      Download
    • memory/2912-2-0x0000000002890000-0x0000000002B3B000-memory.dmp
      Filesize

      2.7MB

      Download
    • memory/2912-3-0x0000000002F90000-0x0000000003019000-memory.dmp
      Filesize

      548KB

      Download
    • memory/2912-4-0x0000000002890000-0x0000000002B3B000-memory.dmp
      Filesize

      2.7MB

      Download