Overview

overview

10

Static

static

3

b576f33767...bc.exe

windows7-x64

10

b576f33767...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b576f3376717226f7e88a2a0950665bc

  • Size

    799KB

  • Sample

    240305-xxgn7seg2s

  • MD5

    b576f3376717226f7e88a2a0950665bc

  • SHA1

    fc6cb60995aadbff13ba36a13171c0d5e32fc889

  • SHA256

    bbda658833fd7e14fb605f3bb5c7698d1b6db08539ef0a20c2b7a3b39fe4d2dc

  • SHA512

    9f8a7c0c4604d612325c4eb21027ad17d74fcbbef408482df65ae2542a53cd6638b84aa2ada7e378db108841c0ab00bc595a7264c9094d783a2cccb9a6a80caf

  • SSDEEP

    12288:rCtP1JSy90AQO0ONLVIXu8mYac5LUECvn314MCzyAdlAUhCp5f7VqF:CnSywO0+8mkUd314nOzU83

Score
10/10
cobaltstrike426352781backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://121.196.195.112:8880/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • host

    121.196.195.112,/jquery-3.3.1.min.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAUSG9zdDogd3d3LmpxdWVyeS5jb20AAAAKAAAAIFJlZmVyZXI6IGh0dHA6Ly9jb2RlLmpxdWVyeS5jb20vAAAACgAAAEVVc2VyLUFnZW50OiBNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNS4xOyAzNjBTRSkAAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAUSG9zdDogd3d3LmpxdWVyeS5jb20AAAAKAAAAIFJlZmVyZXI6IGh0dHA6Ly9jb2RlLmpxdWVyeS5jb20vAAAACgAAAEVVc2VyLUFnZW50OiBNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNS4xOyAzNjBTRSkAAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    45000

  • port_number

    8880

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCi2C+aJ8Qbn+57ZTFt9LB8FsLVJiPEHchi6sZwTNHPEi40kmxsg2xFwCmM5xnVCpVYMchR8KKX/IagzWt3/UylF0YfqI08EnUZZb7UHWVGN93VuBLNVg7jANmA5GfxU5SJfQq1YbfgEBTu7Tf3jidJ/5frfj/Xx2d09oIaP700WQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /jquery-3.3.2.min.js

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

  • watermark

    426352781

Targets

    • Target

      b576f3376717226f7e88a2a0950665bc

    • Size

      799KB

    • MD5

      b576f3376717226f7e88a2a0950665bc

    • SHA1

      fc6cb60995aadbff13ba36a13171c0d5e32fc889

    • SHA256

      bbda658833fd7e14fb605f3bb5c7698d1b6db08539ef0a20c2b7a3b39fe4d2dc

    • SHA512

      9f8a7c0c4604d612325c4eb21027ad17d74fcbbef408482df65ae2542a53cd6638b84aa2ada7e378db108841c0ab00bc595a7264c9094d783a2cccb9a6a80caf

    • SSDEEP

      12288:rCtP1JSy90AQO0ONLVIXu8mYac5LUECvn314MCzyAdlAUhCp5f7VqF:CnSywO0+8mkUd314nOzU83

    Score
    10/10
    cobaltstrike426352781backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks