General
-
Target
3060-4-0x0000000002B20000-0x0000000002B9E000-memory.dmp
-
Size
504KB
-
MD5
2a8739a3c26dea2035affd9e5a8c653c
-
SHA1
ed3f31f705b06c37855ec26adb312d4a720f885d
-
SHA256
91c7dd0daf2aa3978fbaf99ae5ce7aa4c70fec9e2e8db65691394b5578f0c028
-
SHA512
4719ef3983df5dc5e1c2e956f84e62b05637aeb0e0fe3d73c27919d41ae68176894086827bb83fa030c959f33671d721f25c37debbff02d33e0e3f05426ab9c2
-
SSDEEP
3072:8AgWGmZmxfXkahUGIGo7viEXFCoOesCmL2J7ubUZjtUoQ2:7gbfXh4KEXFCoOc7ub0jL
Malware Config
Extracted
cobaltstrike
100000000
http://207.148.109.8:443/ptj
-
access_type
512
-
beacon_type
2048
-
host
207.148.109.8,/ptj
-
http_header1
AAAACgAAAF1BY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCwqLyo7cT0wLjgAAAAKAAAATEFjY2VwdC1MYW5ndWFnZTogemgtQ04semg7cT0wLjgsemgtVFc7cT0wLjcsemgtSEs7cT0wLjUsZW4tVVM7cT0wLjMsZW47cT0wLjIAAAAKAAAAXFVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQ7IHJ2OjEwMi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEwMi4wAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAKAAAAGFNlYy1GZXRjaC1EZXN0OiBkb2N1bWVudAAAAAcAAAAAAAAADQAAAAUAAAACd2EAAAAJAAAADnBhdGg9L2NhbGVuZGFyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAoAAAALQWNjZXB0OiAqLyoAAAAHAAAAAQAAAA0AAAAFAAAAAndhAAAABwAAAAAAAAANAAAAAgAAAAZ3bGE0Mj0AAAACAAAAC3hpZD03MzBiZjc7AAAAAgAAABJNU1BBdXRoPTNFa0FqREtqSTsAAAACAAAAJU1TMD0xYWZkNGZiMzc5NzE0MzU3YTU5NTMyYTI0YmVmNTJiNDsAAAACAAAAK0VYUElEPTMwN2Y3ZWRkLWIwN2ItNGJkNC1iZThhLTE2ZmYyYTlhM2U0NzsAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
10240
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFmCVAqjwVXuM7g1vpo6ws7F+89TG0j5DCCRZfoZgIoX/jC+Up1bO/cQEM8vbtN5DBXbM/fGccz/PaIU+FnDwN1pCtQkzmF7yvQlPeTsKLNRPWe+HbkFdFgx01MKs9suqkR0K+kN25zEqFkboK0/TnaNbCV7dOLkfXXNiphNvoywIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.448416512e+09
-
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/OWA/
-
user_agent
Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.50
-
watermark
100000000
Signatures
-
Cobaltstrike family
Files
-
3060-4-0x0000000002B20000-0x0000000002B9E000-memory.dmp