cobaltstrike | 391a772d438fda8bf2727ae051a290b8cb455a9317ce825494afb258dbaaf388

General

Target
bc169e0476662ee08e8def5a6150d8b2306fe8ff61ae3c012bc9ccc09d7443d9.zip
Size 114KB
Sample240831-ttk1nstcph
SHA256 391a772d438fda8bf2727ae051a290b8cb455a9317ce825494afb258dbaaf388
MD5 7fb937ea3233e20e3c3a6972ec95ba28
SHA1 beebc8151819e455a5d11081ba133edbe20fc72a
SHA512 4fda063013bc782825750d924ec03e829e5a0750c6b1b87620f573d645bc56d9a97f9fb7a8d78b3d8994f866e373bcb08dfc691dbe9d48f83350dff283ff63a2
SSDEEP 3072:jYCkSlh4hvRZtzqob3GGwOxDD/BJyefFA7rBaxCP:Vk+OvRP5b2UxDD/stP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 0 discovery

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://js.msedgeupdate.com:443/activity

Attributes

access_type
512
beacon_type
2048
host
js.msedgeupdate.com,/activity
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
10
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZw/DmtnwpDL27w1qY2zUCH/B70ZWnZDMrGbCYn6Nm/2N76HOJTEMeolLOq4jNnK1wAEqggEwwQwvLu3eCwoal0+5SjiTXKu0T4tRLQM/eSjuLcumxh//mIM31Vox7xoRoS+LWGnnxkgnj7bo5VSPdCnHzYE+CXzyqfASAZBt/1wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
watermark
0

Targets

- Target
  bc169e0476662ee08e8def5a6150d8b2306fe8ff61ae3c012bc9ccc09d7443d9
- Size 207KB
- SHA256 bc169e0476662ee08e8def5a6150d8b2306fe8ff61ae3c012bc9ccc09d7443d9
- MD5 3d01fff7c1455b004eecb97472851037
- SHA1 cf4ff82184c815993b1347e26196f16869408499
- SHA512 e0c026d4177c25fded9ab9994b340e08e1022229c425b5cea88105137c64d77ad6724a2ad85822ff886b99220388caf05f7aaf9c171697451f768188913a12e9
- SSDEEP 3072:KlC60GeD6N9Za5Yp6zPC952DmKX0tDV2/jqBkLcP6j5UF5I:KNxfaWUzPWEKKX0pURLcyj/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2