Overview

overview

10

Static

static

3

e909c245ee...18.exe

windows7-x64

10

e909c245ee...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2024 11:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e909c245ee51610ee8e89985dcf48b29_JaffaCakes118.exe

  • Size

    2.5MB

  • MD5

    e909c245ee51610ee8e89985dcf48b29

  • SHA1

    39a9542789a40b7d894182c5b156abb439f7b464

  • SHA256

    ffa7eee89bdc18604d7acb525bb04485c14c086aebfae8ff02ee7bfc6e73f969

  • SHA512

    7e77b8f0a2f0007e06a87e4ec7c4898b2a2f61c5d88c8b3cf9daabe3497c83b39dbfc1d67bbf76208f270b1a4e63e5487c83df321707df0a2ab13f12ebce3b36

  • SSDEEP

    24576:AX8/o6dDgxfkpit3I/dlddNL3bJ6clMi81s3AwHVC65:AX8/o6dIxkPHVC65

Score
10/10
cobaltstrike1359593325backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1359593325

C2

http://10.1.1.96:443/owa/cahHBpthrIHxkMdguWrcD5BDHm

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    10.1.1.96,/owa/cahHBpthrIHxkMdguWrcD5BDHm

  • http_header1

    AAAAEAAAACBIb3N0OiBkb3dubG9hZC53aW5kb3dzdXBkYXRlLmNvbQAAAAoAAAALQWNjZXB0OiAqLyoAAAAKAAAAhkNvb2tpZTogTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQ9OTVjMThkOC00ZGNlOTg1NDtDbGllbnRJZD0xQzBGNkM1RDkxMEY5O01TUEF1dGg9M0VrQWpES2pJO3hpZD03MzBiZjc7d2xhNDI9WkcweU16QTJLakVzAAAABwAAAAAAAAANAAAABQAAAAJ3YQAAAAkAAAAOcGF0aD0vY2FsZW5kYXIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAACBIb3N0OiBkb3dubG9hZC53aW5kb3dzdXBkYXRlLmNvbQAAAAoAAAALQWNjZXB0OiAqLyoAAAAHAAAAAQAAAA0AAAAFAAAAAndhAAAABwAAAAAAAAANAAAAAgAAAAZ3bGE0Mj0AAAACAAAAC3hpZD03MzBiZjc7AAAAAgAAABJNU1BBdXRoPTNFa0FqREtqSTsAAAACAAAAF0NsaWVudElkPTFDMEY2QzVEOTEwRjk7AAAAAgAAADhNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZD05NWMxOGQ4LTRkY2U5ODU0OwAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • jitter

    9728

  • polling_time

    3000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\logman.exe

  • sc_process64

    %windir%\sysnative\logman.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCflzEWcQDlZZ+w2BTCcTWvA+z5d7LLTvF7HkK/PN8No0Vatb/qr8SKaejPqEubJwb9pFm87/fcQtd43uvzbPuBQcAPfUMgh5HPhmJyrc5D14lxruF0C3K55dvwWftUcBqeA+n6fE32H/yxSUm3KBIKJeMWT6ViLHz6olEcbR5P2QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.448416512e+09

  • unknown2

    AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /owa/6RYaNsFzBj9jwWm9l2KMCi67byMkP8Nwc8Xg

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66

  • watermark

    1359593325

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e909c245ee51610ee8e89985dcf48b29_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e909c245ee51610ee8e89985dcf48b29_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3104-0-0x0000000000180000-0x00000000001C0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/3104-2-0x0000000000780000-0x00000000007E5000-memory.dmp

    Filesize

    404KB

    Download

  • memory/3104-3-0x0000000000400000-0x000000000057F000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/3104-5-0x0000000000780000-0x00000000007E5000-memory.dmp

    Filesize

    404KB

    Download