AES-256-GCM Coinbase backup

[hashfucker]

I have a Coinbase seed phrase backup which is purportedly encrypted with AES-256-GCM encryption.  The 12 word seed phrase looks like this test backup: 1WKkQX7s_T3E3zDvijWhOBarbzzXfDSY+fL7rsYgYEA=  I would like to use Hashcat to attempt to crack the password that will unlock the seed phrase, but it seems like there is a lot going on here. I am assuming that the whole 12 words isn't being encrypted because I think it would not be possible to store this in 44 characters. Perhaps the first few letters of each BIP39 word is encrypted. Does anyone have experience with this or know how I might get started? 

Here is how Coinbase explains thier google drive backup: "As an added safeguard, we built an encrypted Google Drive and iCloud feature so you can back up your recovery phrase."

When I tested it, I was able to restore the seed phrase using only the text "1WKkQX7s_T3E3zDvijWhOBarbzzXfDSY+fL7rsYgYEA=" and the password.

Code:

def convert_to_hashcat_format(encrypted_data):
    # Parse the JSON string
    data = json.loads(encrypted_data)

    # Extract the necessary fields
    iterations = 300000  #?
    salt = base64.b64encode(bytes(data["salt"])).decode()
    iv = base64.b64encode(bytes(data["passwordIv"])).decode()
    mnemonic = data["SOME_KEY"] #!

    # Construct the hashcat format string
    hashcat_format = f'$SOME_MODULE${iterations}${salt}${iv}${mnemonic}'  #!

    return hashcat_format

# Example usage
encrypted_data = '{"ultiAccountEncryptedMnemonic":"/MQ5BKTJw9Ghy47Dod2bh0OngvAESvnj+QAepD7UgXQKJWaz3TNiXJAFnHNzCvxMRioQUqEmWCe8aQ=","salt":[33,23,217,22,81,26,111,247,252,38,239,158,93,94,19,61,135,195,124,22,175,26,161,72,235,240,25,10,99,149,9,51],"passwordIv":[44,32,60,200,4,2,136,42,11,206,22,72]}'

hashcat_format = convert_to_hashcat_format(encrypted_data)
print(hashcat_format)