Overview

overview

10

Static

static

3

北京邮...cx.lnk

windows10-2004-x64

10

附件/doc...64.dll

windows10-2004-x64

1

附件/doc...LP.exe

windows10-2004-x64

10

附件/关....doc

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    北京邮电大学-硕士研究生-个人简历-高级软件开发工程师.docx (2).zip

  • Size

    665KB

  • Sample

    240412-emp9gsed46

  • MD5

    83fc01e675c9e102329e90406816dfd5

  • SHA1

    fc6afbec6c589ebd510744dcb06124cd553dde2a

  • SHA256

    8c7eef657b6be51f6a0ef776219366ae277d31e2a9d4dfd51ff8c8766894b84e

  • SHA512

    d505ef60e620d917e969ea75ccbbe50c05bb88447de173294a23dda07643d70038731b8f4ca02f8d4b212591a3c93300aa1743d6a2b9e3638936a4a1edef22a5

  • SSDEEP

    12288:VgbpWgUVqcZfuhCceE66j+ECZSyt/XrZWRhCZBj17+WO2Vg9FTRgwDlHYq9CVbJ:SWgmZGh/eEXkZSytDZWRhCZzNhWR/l4t

Score
10/10
cobaltstrike100000backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://124.220.27.131:1443/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    124.220.27.131,/jquery-3.3.1.min.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    9472

  • polling_time

    45000

  • port_number

    1443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkIYpEQhYcWv4IFd/CtYxePMOrGRAbBk0brIprsIxq/tHsgVrP8+SMaXaxWXrfvLne5rT//eah9ubL7uPrGQTQM7PkYCZrhCkIv+0HmlHdlep8J1xgpKAxOqx0E0CKllxsjDLfGtGrj8ZLVFgiTDACVK/3ofj+2SGOy6PZaNoXUwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /jquery-3.3.2.min.js

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

  • watermark

    100000

Targets

    • Target

      北京邮电大学-硕士研究生-个人简历-高级软件开发工程师.docx.lnk

    • Size

      670B

    • MD5

      c481cef253b0478de7356c5ed3441378

    • SHA1

      e9874dd2b9ee2c23b34ca09e04daf92473193000

    • SHA256

      6e25c892602a0ba3db273e6bd661405f2dca757567667109aa3d30686b890540

    • SHA512

      90941a489d43f6adb99c7a5a19b96d10afe4ce64c3a69d28fb36bea2306b4ca5451a787233b615def59544be6dff34e11d1c27178b54e65debed651bd75ba50d

    Score
    10/10
    cobaltstrike100000backdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

    • Target

      附件/docx/AppVIsvSubsystems64.dll

    • Size

      1.1MB

    • MD5

      0c60e150bc32545fd2837cf5280398af

    • SHA1

      9edec80cd4d22727431778795fc94fcdd02af889

    • SHA256

      c5ca89b5bbf4d19079dce1954c245bb5cc2b3bd63f98ddc23f1329365ef4dd06

    • SHA512

      955e5a64e85afe17e0909fe466e11d31b284d27029b5c2a4ae619b3beb7a392ac4040c8fbaf67e840409f9c81a57033a7ce6a257624d9e2bf894cffd380ee5ab

    • SSDEEP

      24576:ik7fYerH7nmpWvZahM6iAmZvJRrTgkn242MWUWU4hh6hRJmc:pfYeXmQvZahIQ69V1NUc

    Score
    1/10
    behavioral2

    • Target

      附件/docx/AppVLP.exe

    • Size

      491KB

    • MD5

      425f4dfe0d9df6332f7d12b46e70253e

    • SHA1

      6c6f51a65502575ca0fcd628cfcd6fc305e4f66b

    • SHA256

      b9d464982ca65ebf39ebd0b937df518bdc586dd6566724b962e6ef0d6e340d2e

    • SHA512

      1be196b4d149ad5b440e9506f03ab065317add3195f6af9999fbea6fc82938c8570ced26f59b748bb2bc0e1a0f4e0f2204c49f9ae12eda5d2e29d79ee2d3ca9b

    • SSDEEP

      6144:Bel8fWxABEB0d7WfBKu3nmunYOKGFidAgdvJReeFHQKJ+JOjWGNU6ITLwohEVibk:tfoKu3NnYOKGFAdxRetLGNUbTEosOKn

    Score
    10/10
    cobaltstrike100000backdoortrojan
    behavioral3

    • Target

      附件/关于区块链法院建设性方案提要-相关系统统筹性建设开发.doc

    • Size

      16KB

    • MD5

      120153d48589e7fdab7a0df7858518d3

    • SHA1

      c013a0140efa513a9aed3f2ac4abb8e04c5b3381

    • SHA256

      f2d9e72a63f7513afc2dd77e38f50bfaadb7842fb019432cb23adf881edab99c

    • SHA512

      c88a1ec3bc53f0230b277e6ca84ae2296f318ba858f7ec03dd417e988bf6cae0f2bd3cf35afa4c19de719af35999f99b8e57b4b210a8c8a3e58b2b466c3d60dd

    • SSDEEP

      192:NbAXGHxaem/hqgyZcw7MOglV1jo4DAmD:akxa05oDVN1DjD

    Score
    1/10
    behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks