General
- Target Unconfirmed 757120.crdownload
- Size 13.0MB
- Sample240227-lpd3kade66
- SHA256 300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12
Malware Config
Extracted
-
cobaltstrike
-
51451532
-
http://pandorasong.com:443/access/
-
access_type
512
-
beacon_type
2048
-
host
pandorasong.com,/access/
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAeR2V0Q29udGVudEZlYXR1cmVzLkRMTkEuT1JHOiAxAAAACgAAABVIb3N0OiBwYW5kb3Jhc29uZy5jb20AAAAKAAAASENvb2tpZTogIF9fdXRtYT0zMTAwNjY3MzMuMjg4NDUzNDQ0MC4xNDMzMjAxNDYyLjE0MDMyMDQzNzIuMTM4NTIwMjQ5OC43OwAAAAkAAAAJdmVyc2lvbj00AAAACQAAAA5saWQ9MTU4MjUwMjcyNAAAAAcAAAAAAAAACAAAAAUAAAAFdG9rZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFUhvc3Q6IHBhbmRvcmFzb25nLmNvbQAAAAcAAAAAAAAABQAAAANyaWQAAAAJAAAADmxpZD0xNjgzNTAzNzM1AAAACQAAAB9tZXRob2Q9Z2V0U2VhcmNoUmVjb21tZW5kYXRpb25zAAAABwAAAAEAAAADAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
jitter
4352
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
300000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCN7UFLcBHjvme4lLXoOKMyNrF46j4Xi87J4ilrNPDQxLOq2KHaCXP+0FsWYs7JFqLXGmqOIfALpPLIyGgnRuC60ZXaSKmCENE2O88Z0BxDkRxSaKEbgv3ETo/Ra7cF8JNr3szy0sNBVyi9dhS2WhXRIU923X2ZQxbpSyUNi5Q//wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
7.382016e+08
-
unknown2
AAAABAAAAAIAAAAQAAAAAgAAABAAAAACAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/radio/xmlrpc/v45
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
51451532
Targets
-
- Target Unconfirmed 757120.crdownload
- Size 13.0MB
- SHA256 300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12
Score1/10 -
- Target Coll.CozyBear
- Size 12.8MB
- SHA256 fdef234179cd467f728ae51dbb206f1577bc2d73834d105e51a824063f4926c0
Score1/10 -
- Target APT29miniduke.bin
- Size 140KB
- SHA256 dd215d76bcfd72ebcfb50ccfeb9fb1703af4bbf4821de225009f43fc4e08e432
Score3/10 -
- Target CozyBearImplant.bin
- Size 3.0MB
- SHA256 b101cd29e18a515753409ae86ce68a4cedbe0d640d385eb24b9bbb69cf8186ae
Score7/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
Score3/10 -
- Target ImplantCozy.bin
- Size 3.0MB
- SHA256 6c1bce76f4d2358656132b6b1d471571820688ccdbaca0d86d0ca082b9390536
Score7/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
Score3/10 -
- Target MinidukeAPT29.bin
- Size 140KB
- SHA256 c485cbcd5b21db8029654bd47879f086feed41492aebed33a9afe9d73f5069e7
Score3/10 -
- Target Nov2018New!/.DS_Store
- Size 6KB
- SHA256 d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
Score3/10 -
- Target Nov2018New!/AudioSes.dll
- Size 287KB
- SHA256 b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request
-
- Target Nov2018New!/CozybearNov2018Activity.txt
- Size 148B
- SHA256 07a1d57137b3a7bea66f2f599c95aaf7765e24bcbbefcaf6f7885381d92ded89
Score3/10 -
- Target Nov2018New!/ds7001.zip
- Size 228KB
- SHA256 e2945268c976f8dc33ba9a8d1a804f00cff46aabc01cd3196651322a71863b87
Score1/10 -
- Target ds7002.lnk
- Size 392KB
- SHA256 2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
- Target Nov2018New!/ds7002.bin
- Size 392KB
- SHA256 2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
- Target Nov2018New!/ds7002.zip
- Size 54KB
- SHA256 1cc77858e5f3513a051a8cf2895891eebe52fdd604017b55030fed0d63cf3faf
Score1/10 -
- Target ds7002.pdf
- Size 85KB
- SHA256 b1c811d3f0e930b0096a9e785f730ba4d92458bd6dcfbdff4cf7a1e247ef20d1
Score1/10 -
- Target SeaDaddyImplant (2).bin
- Size 3.0MB
- SHA256 6c1bce76f4d2358656132b6b1d471571820688ccdbaca0d86d0ca082b9390536
Score7/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
Score3/10 -
- Target SeaDaddyImplant.bin
- Size 3.0MB
- SHA256 b101cd29e18a515753409ae86ce68a4cedbe0d640d385eb24b9bbb69cf8186ae
Score7/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 2.4MB
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
Score3/10 -
- Target TrojanCozyBear.bin
- Size 330KB
- SHA256 01468b1d3e089985a4ed255b6594d24863cfd94a647329c631e4f4e52759f8a9
Score8/10-
Adds policy Run key to start application
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target atiagentCozyBear.bin
- Size 52KB
- SHA256 43cd9ef6904c35c6854bf59d99731a05048af9e870261064a255db0181930fad
Score1/10