General
-
Target
4af1d688f34b4d02d68ea5670c8a1fb816bc5dc50d3bccfe132c32ed228b5584
-
Size
281KB
-
Sample
240320-x156zahe5z
-
MD5
ce3bf17564dafc8d05b5fc331bbfba01
-
SHA1
1836ec38c3ba748edf70430ff236530228b8bdc9
-
SHA256
4af1d688f34b4d02d68ea5670c8a1fb816bc5dc50d3bccfe132c32ed228b5584
-
SHA512
22cd6fafd08a8ad93af383b7dee547425d117f50e56695fb5946380262a36ca5256186344f7bd82701e143ac0042a9c1b9790ca902fe339487f8a87d51bff077
-
SSDEEP
6144:3C+CQ6TOj3//0A+XLS3jeIvZmtd8N6pAhn1aI:9YTOz/wqktd8GAhf
Static task
static1
Behavioral task
behavioral1
Sample
4af1d688f34b4d02d68ea5670c8a1fb816bc5dc50d3bccfe132c32ed228b5584.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4af1d688f34b4d02d68ea5670c8a1fb816bc5dc50d3bccfe132c32ed228b5584.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cobaltstrike
100000
http://192.168.198.190:5678/load
-
access_type
512
-
host
192.168.198.190,/load
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
5678
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAe9dtlT9pOxenoDqDG/tfc+3n5yTggilZWyDVGhihcrWi5ktQlgiR2Sxosu+5llwcask46Xcv08rLhp8z86vA7rdP1MWEWtRSMtmjxKrALJrWqvqr/sgjhDgjGkr/T3GLO0qFYh7kT+IerFcXn+THHMURD8cMNJlXjo1vWXru2QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
-
watermark
100000
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
4af1d688f34b4d02d68ea5670c8a1fb816bc5dc50d3bccfe132c32ed228b5584
-
Size
281KB
-
MD5
ce3bf17564dafc8d05b5fc331bbfba01
-
SHA1
1836ec38c3ba748edf70430ff236530228b8bdc9
-
SHA256
4af1d688f34b4d02d68ea5670c8a1fb816bc5dc50d3bccfe132c32ed228b5584
-
SHA512
22cd6fafd08a8ad93af383b7dee547425d117f50e56695fb5946380262a36ca5256186344f7bd82701e143ac0042a9c1b9790ca902fe339487f8a87d51bff077
-
SSDEEP
6144:3C+CQ6TOj3//0A+XLS3jeIvZmtd8N6pAhn1aI:9YTOz/wqktd8GAhf
Score10/10-
Detects Reflective DLL injection artifacts
-