Overview

overview

10

Static

static

8

024054ff04...c1.xls

windows7-x64

10

024054ff04...c1.xls

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    024054ff04e0fd75a4765dd705067a6b336caa751f0a804fefce787382ac45c1

  • Size

    8.6MB

  • Sample

    240410-k88kvadd5z

  • MD5

    c6e7af8d31a951b8c05565ab18c4f258

  • SHA1

    8da49c2dbaf1abd4b2ba81669b201e2ab5b95926

  • SHA256

    024054ff04e0fd75a4765dd705067a6b336caa751f0a804fefce787382ac45c1

  • SHA512

    3919cb6d07dc31324ad89e35ebdc80b450e4cf9b86edd5e22e44429315f6a83d81ed526b04236e921e5e5637397c33ee1a76aee1fcd46ba7182f3bdcbd24fe54

  • SSDEEP

    196608:b3Rb8KqbcIo/wXJFqQpZu/xqOR/xn94Wtprc7h:L2V3mwvq2Un59rz

Score
10/10
cobaltstrike1580103824backdoormacromacro_on_actionpersistencetrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1580103824

C2

http://skreatortemp.site:443/s/08u1XdxChhMrLYdTasfnOMQpbsLkpq3o/field-keywords/

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    skreatortemp.site,/s/08u1XdxChhMrLYdTasfnOMQpbsLkpq3o/field-keywords/

  • http_header1

    AAAAEAAAABdIb3N0OiBza3JlYXRvcnRlbXAuc2l0ZQAAAAoAAABFQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwvO3E9MC44AAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41AAAABwAAAAAAAAAIAAAAAgAAAA9QUkVGPUlEPUdkMVV0REIAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABdIb3N0OiBza3JlYXRvcnRlbXAuc2l0ZQAAAAoAAABFQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwvO3E9MC44AAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41AAAABwAAAAAAAAAIAAAAAgAAAApVPU50VXFDWi1PAAAAAgAAAAhQUkVGPUlEPQAAAAYAAAAGQ29va2llAAAABwAAAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    6656

  • polling_time

    30000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\svchost.exe

  • sc_process64

    %windir%\sysnative\svchost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnCZHWnYFqYB/6gJdkc4MPDTtBJ20nkEAd3tsY4tPKs8MV4yIjJb5CtlrbKHjzP1oD/1AQsj6EKlEMFIKtakLx5+VybrMYE+dDdkDteHmVX0AeFyw001FyQVlt1B+OSNPRscKI5sh1L/ZdwnrMy6S6nNbQ5N5hls6k2kgNO5nQ7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /nBz07hg5l3C9wuWVCGV-5xHHu1amjf76F2A8i/avp/amznussraps/

  • user_agent

    Mozilla/5.0_Frsg_stredf_o21_rutyyyrui_type (Windows NT 10.0; Win64; x64; Trident/7.0; D-M1-200309AC;D-M1-MSSP1; rv:11.0) like Gecko_10984gap

  • watermark

    1580103824

Targets

    • Target

      024054ff04e0fd75a4765dd705067a6b336caa751f0a804fefce787382ac45c1

    • Size

      8.6MB

    • MD5

      c6e7af8d31a951b8c05565ab18c4f258

    • SHA1

      8da49c2dbaf1abd4b2ba81669b201e2ab5b95926

    • SHA256

      024054ff04e0fd75a4765dd705067a6b336caa751f0a804fefce787382ac45c1

    • SHA512

      3919cb6d07dc31324ad89e35ebdc80b450e4cf9b86edd5e22e44429315f6a83d81ed526b04236e921e5e5637397c33ee1a76aee1fcd46ba7182f3bdcbd24fe54

    • SSDEEP

      196608:b3Rb8KqbcIo/wXJFqQpZu/xqOR/xn94Wtprc7h:L2V3mwvq2Un59rz

    Score
    10/10
    cobaltstrike1580103824backdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks