Overview

overview

10

Static

static

3

e909c245ee...18.exe

windows7-x64

10

e909c245ee...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e909c245ee51610ee8e89985dcf48b29_JaffaCakes118

  • Size

    2.5MB

  • Sample

    240918-nvex6azcrm

  • MD5

    e909c245ee51610ee8e89985dcf48b29

  • SHA1

    39a9542789a40b7d894182c5b156abb439f7b464

  • SHA256

    ffa7eee89bdc18604d7acb525bb04485c14c086aebfae8ff02ee7bfc6e73f969

  • SHA512

    7e77b8f0a2f0007e06a87e4ec7c4898b2a2f61c5d88c8b3cf9daabe3497c83b39dbfc1d67bbf76208f270b1a4e63e5487c83df321707df0a2ab13f12ebce3b36

  • SSDEEP

    24576:AX8/o6dDgxfkpit3I/dlddNL3bJ6clMi81s3AwHVC65:AX8/o6dIxkPHVC65

Score
10/10
cobaltstrike1359593325backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1359593325

C2

http://10.1.1.96:443/owa/cahHBpthrIHxkMdguWrcD5BDHm

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    10.1.1.96,/owa/cahHBpthrIHxkMdguWrcD5BDHm

  • http_header1

    AAAAEAAAACBIb3N0OiBkb3dubG9hZC53aW5kb3dzdXBkYXRlLmNvbQAAAAoAAAALQWNjZXB0OiAqLyoAAAAKAAAAhkNvb2tpZTogTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQ9OTVjMThkOC00ZGNlOTg1NDtDbGllbnRJZD0xQzBGNkM1RDkxMEY5O01TUEF1dGg9M0VrQWpES2pJO3hpZD03MzBiZjc7d2xhNDI9WkcweU16QTJLakVzAAAABwAAAAAAAAANAAAABQAAAAJ3YQAAAAkAAAAOcGF0aD0vY2FsZW5kYXIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAACBIb3N0OiBkb3dubG9hZC53aW5kb3dzdXBkYXRlLmNvbQAAAAoAAAALQWNjZXB0OiAqLyoAAAAHAAAAAQAAAA0AAAAFAAAAAndhAAAABwAAAAAAAAANAAAAAgAAAAZ3bGE0Mj0AAAACAAAAC3hpZD03MzBiZjc7AAAAAgAAABJNU1BBdXRoPTNFa0FqREtqSTsAAAACAAAAF0NsaWVudElkPTFDMEY2QzVEOTEwRjk7AAAAAgAAADhNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZD05NWMxOGQ4LTRkY2U5ODU0OwAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • jitter

    9728

  • polling_time

    3000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\logman.exe

  • sc_process64

    %windir%\sysnative\logman.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCflzEWcQDlZZ+w2BTCcTWvA+z5d7LLTvF7HkK/PN8No0Vatb/qr8SKaejPqEubJwb9pFm87/fcQtd43uvzbPuBQcAPfUMgh5HPhmJyrc5D14lxruF0C3K55dvwWftUcBqeA+n6fE32H/yxSUm3KBIKJeMWT6ViLHz6olEcbR5P2QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.448416512e+09

  • unknown2

    AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /owa/6RYaNsFzBj9jwWm9l2KMCi67byMkP8Nwc8Xg

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66

  • watermark

    1359593325

Targets

    • Target

      e909c245ee51610ee8e89985dcf48b29_JaffaCakes118

    • Size

      2.5MB

    • MD5

      e909c245ee51610ee8e89985dcf48b29

    • SHA1

      39a9542789a40b7d894182c5b156abb439f7b464

    • SHA256

      ffa7eee89bdc18604d7acb525bb04485c14c086aebfae8ff02ee7bfc6e73f969

    • SHA512

      7e77b8f0a2f0007e06a87e4ec7c4898b2a2f61c5d88c8b3cf9daabe3497c83b39dbfc1d67bbf76208f270b1a4e63e5487c83df321707df0a2ab13f12ebce3b36

    • SSDEEP

      24576:AX8/o6dDgxfkpit3I/dlddNL3bJ6clMi81s3AwHVC65:AX8/o6dIxkPHVC65

    Score
    10/10
    cobaltstrike1359593325backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks