Overview

overview

10

Static

static

3

e134bca370...18.exe

windows7-x64

10

e134bca370...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06-04-2024 09:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e134bca3704fcb507dc6b6524114417c_JaffaCakes118.exe

  • Size

    278KB

  • MD5

    e134bca3704fcb507dc6b6524114417c

  • SHA1

    a84bda8a918c8ee57f665ee7afce1df8a4289fe8

  • SHA256

    ef4008effed1c6251e52ca8ea9db6dd7dfad35aaa84ced8335225c9d8d77ac84

  • SHA512

    e6b4256e3e1b659494eea41f04a109ad0eacb2dfb4ee797836a3f5c6ecd731ea3b1726fcddaa69b21de1c2fc990f4bc0c85f4ebb40d0aabcf41fc914218331d5

  • SSDEEP

    6144:AR9K7cARH27K66cKAz4M0csFdpZvTtLyI/wsa:AbK7LRH27K6lDqLFHZvTtLf/j

Score
10/10
cobaltstrike426352781backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://101.99.90.100:443/chunk-responsive-underlinenav-0ff33106.js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    101.99.90.100,/chunk-responsive-underlinenav-0ff33106.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAQSG9zdDogZ2l0aHViLmNvbQAAAAoAAAAcUmVmZXJlcjogaHR0cHM6Ly9naXRodWIuY29tLwAAAAoAAAAtQWNjZXB0LUVuY29kaW5nOiBkZWZsYXRlLCBnemlwO3E9MS4wLCAqO3E9MC41AAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAABAAAAAQSG9zdDogZ2l0aHViLmNvbQAAAAoAAAAcUmVmZXJlcjogaHR0cHM6Ly9naXRodWIuY29tLwAAAAoAAAAtQWNjZXB0LUVuY29kaW5nOiBkZWZsYXRlLCBnemlwO3E9MS4wLCAqO3E9MC41AAAABwAAAAAAAAAPAAAADQAAAAUAAAAIX19jZmR1aWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    1280

  • polling_time

    45000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZTb0Ql3gSVQxRRUPq7wOFkOVv3j1+y/kNCVrB5bhk6vnDeqhfuvQSWJ/ohX70qnHxwkbx8Ik4XmTGG6f1mAJkuXJmeaenXJELm1b/uxCzAk3ecsnrIOMxz4aJ39Hr5iciHbFoCfnOV6S0K1vRl7T9GSDFlgfZAyLrjsYExQIm9wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    3.983152384e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAEUAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /behaviors-1cbe5abc.js

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0

  • watermark

    426352781

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\e134bca3704fcb507dc6b6524114417c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e134bca3704fcb507dc6b6524114417c_JaffaCakes118.exe"
    1⤵
      PID:1776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1776-0-0x0000000000360000-0x0000000000394000-memory.dmp
      Filesize

      208KB

      Download
    • memory/1776-1-0x0000000000B70000-0x0000000000FE2000-memory.dmp
      Filesize

      4.4MB

      Download
    • memory/1776-2-0x0000000000B70000-0x0000000000FE2000-memory.dmp
      Filesize

      4.4MB

      Download
    • memory/1776-3-0x0000000000400000-0x000000000044B000-memory.dmp
      Filesize

      300KB

      Download