Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 04:43

General

  • Target

    14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe

  • Size

    10.3MB

  • MD5

    14b8871a783f6d8d8f335b503e6dc7b2

  • SHA1

    c0e1757cf3510a16edd91c229a3da148a297fc37

  • SHA256

    3dcf1ef8cd50a04198bc7d8392f1512ae50f0fc8f195b98d25831d695826306b

  • SHA512

    9e60b6cc4453608cb9f75f056a8abe71539a61d0d9bf632cf03753737318b8c4c07918eefe2ace4da11e86ba96790f490fcc1c1def8f504ac0c2564ccffa01bc

  • SSDEEP

    196608:Td+GIxLVhQ9onJ5hrZERoyiU8AdZYJERS48RmU/3ZlsPvD2aRLrTOg8CORKRqbZ:UPVVm9c5hlER0AdZYygtN3ZWqahriR

Malware Config

Extracted

Family

cobaltstrike

C2

http://207.148.112.209:443/ODee

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\VCRUNTIME140.dll

    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\_ctypes.pyd

    Filesize

    122KB

    MD5

    29da9b022c16da461392795951ce32d9

    SHA1

    0e514a8f88395b50e797d481cbbed2b4ae490c19

    SHA256

    3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

    SHA512

    5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\_socket.pyd

    Filesize

    77KB

    MD5

    f5dd9c5922a362321978c197d3713046

    SHA1

    4fbc2d3e15f8bb21ecc1bf492f451475204426cd

    SHA256

    4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

    SHA512

    ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\base_library.zip

    Filesize

    761KB

    MD5

    81a81220192e1cc8231f0fb84893e8ac

    SHA1

    381513ca91bb8ea4c237c2220b0b858f1c8bbb86

    SHA256

    075ec82c1d46cdc2d81d346c9576c73a78547d42076467d5d11a8517850d9b1e

    SHA512

    7ca97f218f07137bd050d1f562c9c71d9f11ba6b110e1a13092c53b541896c3d349a967525dcfc6d607d6c3c3ed43cb7518620137c4442f2f8ba6d40f0a8fa13

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\loader.exe.manifest

    Filesize

    1KB

    MD5

    2aeec77fe026972dfb7f8ff8a14dc9c2

    SHA1

    aa619632e32027b0430c7d8d9e294971ac8e4595

    SHA256

    3d555efb9aedd7a6444d0366e772db410c3ecd9a2da785c22fb97475b0758fbf

    SHA512

    f0929def24035123ac1949bd93715c7e80652c301c3514d4e9d731cee6deca0a753c376496f6ae2433bcdfcb537c855c504f0bd44442832b012f52edbc8ac076

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\python39.dll

    Filesize

    4.3MB

    MD5

    11c051f93c922d6b6b4829772f27a5be

    SHA1

    42fbdf3403a4bc3d46d348ca37a9f835e073d440

    SHA256

    0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

    SHA512

    1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\select.pyd

    Filesize

    26KB

    MD5

    7a442bbcc4b7aa02c762321f39487ba9

    SHA1

    0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

    SHA256

    1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

    SHA512

    3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

  • C:\Users\Admin\AppData\Local\Temp\_MEI25602\ucrtbase.dll

    Filesize

    1000KB

    MD5

    126821f73fd9ffce6e091cf9480e1b60

    SHA1

    d10bbe9b65c2c6f8fca6850d0b79cbc6ef04d691

    SHA256

    7b28f46f0a09cfd9129109a94b1c16c9c62eef46c09113c4c585d9bf0e69b2da

    SHA512

    e61ad6c90551022fc257be95f6296a9f7d5a7aeaabd5349d81b1b31ea69b75dc3397698331f363d9fc2b005d9289a06dc1dcc2078e74b52775e0aae64daea36e

  • memory/1252-999-0x000001DEF6FD0000-0x000001DEF6FD1000-memory.dmp

    Filesize

    4KB