Overview

overview

10

Static

static

3

8df542ca32...81.exe

windows7-x64

7

8df542ca32...81.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 07:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8df542ca32d53e106bbf0cf95b17649d0364a90ff84f19e3f7e3704674eb1081.exe
  • Size 10.3MB
  • Sample240823-jta6csvfjl
  • SHA256 8df542ca32d53e106bbf0cf95b17649d0364a90ff84f19e3f7e3704674eb1081
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrike0100000backdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

Attributes
  • watermark

    0

Extracted

Family

  • cobaltstrike

Botnet

  • 100000

C2

  • http://172.16.90.207:443/www/handle/doc

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    172.16.90.207,/www/handle/doc

  • http_header1

    AAAABwAAAAAAAAANAAAAAgAAAApTRVNTSU9OSUQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAABwAAAAAAAAAPAAAACwAAAAUAAAADZG9jAAAABwAAAAEAAAAPAAAADQAAAAIAAAAFZGF0YT0AAAABAAAAAiUlAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    1

  • port_number

    443

  • sc_process32

    c:\windows\syswow64\rundll32.exe

  • sc_process64

    c:\windows\system32\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXR6dEL2D5D5PA0hFqADKMvQ60p56YoPVQbuEx+kAUCiYpCwNgOc+QWflJNwmd1P+Qqlpsnula1MPg8XFvV1MYBNyzWtyVSkd5+12DwvJ4yQ1itGOOJt/u/dVPodhTlTLl8G//5ibjH/LXduCfPZmQUmL5kApcSCnAe+C21IpP3QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    2.51666432e+08

  • unknown2

    AAAABAAAAAEAAAACAAAAAgAAAAUAAAAIAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /IMXo

  • user_agent

    Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

  • watermark

    100000

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 32 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8df542ca32d53e106bbf0cf95b17649d0364a90ff84f19e3f7e3704674eb1081.exe
    "C:\Users\Admin\AppData\Local\Temp\8df542ca32d53e106bbf0cf95b17649d0364a90ff84f19e3f7e3704674eb1081.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\demo2-mini.exe
      C:\Users\Admin\AppData\Local\Temp\8df542ca32d53e106bbf0cf95b17649d0364a90ff84f19e3f7e3704674eb1081.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1148

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _pkcs1_decode.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_pkcs1_decode.pyd
        • Size 13KB
        • SHA256 38e423d3bcc32ee6730941b19b7d5d8872c0d30d3dd8f9aae1442cb052c599ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_BLAKE2s.pyd
        • Size 14KB
        • SHA256 fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _scrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Protocol\_scrypt.pyd
        • Size 12KB
        • SHA256 b1bab0e04ac60d1e7917621b03a8c72d1ed1f0251334e9fa12a8a1ac1f516529
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _Salsa20.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_Salsa20.pyd
        • Size 13KB
        • SHA256 15257e96d1ca8480b8cb98f4c79b6e365fe38a1ba9638fc8c9ab7ffea79c4762
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_aes.pyd
        • Size 35KB
        • SHA256 9524d1dadcd2f2b0190c1b8ede8e5199706f3d6c19d3fb005809ed4febf3e8b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 1f4288a098da3aac2add54e83c8c9f2041ec895263f20576417a92e1e5b421c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_cbc.pyd
        • Size 12KB
        • SHA256 11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_cfb.pyd
        • Size 13KB
        • SHA256 faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_ctr.pyd
        • Size 14KB
        • SHA256 61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_des.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_des.pyd
        • Size 56KB
        • SHA256 c4769d3e6eb2a2fecb5dec602d45d3e785c63bb96297268e3ed069cc4a019b1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_ecb.pyd
        • Size 10KB
        • SHA256 3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ocb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_ocb.pyd
        • Size 17KB
        • SHA256 4aa5e9ce7a76b301766d3ecbb06d2e42c2f09d0743605a91bf83069fefe3a4de
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Cipher\_raw_ofb.pyd
        • Size 12KB
        • SHA256 c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _MD5.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Hash\_MD5.pyd
        • Size 15KB
        • SHA256 4fc70cb9280e414855da2c7e0573096404031987c24cf60822854eaa3757c593
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Hash\_SHA1.pyd
        • Size 19KB
        • SHA256 a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Hash\_SHA256.pyd
        • Size 21KB
        • SHA256 3dbcb4d0070be355e0406e6b6c3e4ce58647f06e8650e1ab056e1d538b52b3d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_clmul.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Hash\_ghash_clmul.pyd
        • Size 12KB
        • SHA256 e5b6e58d6da8db36b0673539f0c65c80b071a925d2246c42c54e9fcdd8ca08e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_portable.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Hash\_ghash_portable.pyd
        • Size 13KB
        • SHA256 8f3d92de840abb5a46015a8ff618ff411c73009cbaa448ac268a5c619cf84721
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _modexp.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Math\_modexp.pyd
        • Size 35KB
        • SHA256 48f296ccace3878de1148074510bd8d554a120cafef2d52c847e05ef7664ffc6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 0828cad4d742d97888d3dfce59e82369317847651bba0f166023cb8aca790b2b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\Crypto\Util\_strxor.pyd
        • Size 10KB
        • SHA256 70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\_bz2.pyd
        • Size 83KB
        • SHA256 f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\_ctypes.pyd
        • Size 122KB
        • SHA256 be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\_lzma.pyd
        • Size 156KB
        • SHA256 a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\_socket.pyd
        • Size 81KB
        • SHA256 7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\_wmi.pyd
        • Size 35KB
        • SHA256 1a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        demo2-mini.exe
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\demo2-mini.exe
        • Size 10.6MB
        • SHA256 98bcb0f903d930358f45aea083bc99b96b49c1ea9e1de4bdc61b70080bac0fc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\python312.dll
        • Size 6.6MB
        • SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\select.pyd
        • Size 29KB
        • SHA256 680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2092_133688734383759777\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1148-110-0x00000211B4FC0000-0x00000211B53C0000-memory.dmp
        Download

        memory/1148-111-0x00000211B5540000-0x00000211B558F000-memory.dmp
        Download

        memory/1148-114-0x00007FF69F570000-0x00007FF6A0024000-memory.dmp
        Download

        memory/1148-115-0x00000211B4FC0000-0x00000211B53C0000-memory.dmp
        Download

        memory/2092-10-0x00007FF6F6B50000-0x00007FF6F75C9000-memory.dmp
        Download

        memory/2092-112-0x00007FF6F6B50000-0x00007FF6F75C9000-memory.dmp
        Download