cobaltstrike | 287aae0d0192654d709742977dfb6219856096d8b05cf7592b2adfd96bb2d976

Analysis

max time kernel
124s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
11/03/2021, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
287aae0d0192654d709742977dfb6219856096d8b05cf7592b2adfd96bb2d976.exe
Size 217KB
Sample210311-4p65lhdtx2
SHA256 287aae0d0192654d709742977dfb6219856096d8b05cf7592b2adfd96bb2d976
MD5 7b40b0ceccafb4a9acd393330c528be2
SHA1 3bcea3d8bc6b02ed45581be9d5479054d049bb0b
SHA512 98ca0e68f53cac0069027ea03a88151e0a7b336cee11776582c9de14ef989daf88cae40957b9c1b829e984696ff261c4d663fa382edceea12057e031098f597c
MD5 SHA1 SHA512

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://78.129.165.207:80/__utm.gif

Attributes

access_type
512
beacon_type
0
create_remote_thread
0
day
0
dns_idle
0
dns_sleep
0
host
78.129.165.207,/__utm.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
injection_process
jitter
0
maxdns
255
month
0
pipe_name
polling_time
60000
port_number
80
proxy_password
proxy_server
proxy_username
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCY/3/4duPD6UZJPaRmmpREq4nOR1vCoXknj/DMLZReeF5pQ1mtqwYAmyy/5r4eP4GjH7MsVO6XLDNWNrcvkBWsif+pnDCniEo6A8JvbIKP75l2e/gmCYdTLClzgaPEaiCZiONS0MedB++t90WBIZ63RsJ+22AllSmKkw7/g4xP1QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown3
0
unknown4
0
unknown5
0
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAM2)
year
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\287aae0d0192654d709742977dfb6219856096d8b05cf7592b2adfd96bb2d976.exe
"C:\Users\Admin\AppData\Local\Temp\287aae0d0192654d709742977dfb6219856096d8b05cf7592b2adfd96bb2d976.exe"
1⤵
PID:292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-2-0x0000000076861000-0x0000000076863000-memory.dmp

Download

memory/292-3-0x0000000000220000-0x000000000025D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads