Overview

overview

10

Static

static

123.exe

windows7_x64

10

123.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    19/04/2021, 11:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    123.exe
  • Size 4.3MB
  • Sample210419-fbj176329x
  • SHA256 2df05a70d3ce646285a0f888df15064b4e73034b67e06d9a4f4da680ed62e926
  • MD5 SHA1 SHA512
Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://101.72.205.224:443/config

  • http://112.25.18.134:443/admin

  • http://118.123.241.220:443/admin

  • http://121.207.229.145:443/admin

  • http://122.193.130.74:443/login

  • http://122.228.7.225:443/admin

  • http://123.6.10.169:443/admin

  • http://124.236.20.207:443/admin

  • http://125.37.206.220:443/config

  • http://125.76.247.185:443/login

  • http://140.249.60.193:443/admin

Attributes
  • access_type

    512

  • beacon_type

    2048

  • create_remote_thread

    0

  • day

    0

  • dns_idle

    0

  • dns_sleep

    0

  • host

    101.72.205.224,/config,112.25.18.134,/admin,118.123.241.220,/admin,121.207.229.145,/admin,122.193.130.74,/login,122.228.7.225,/admin,123.6.10.169,/admin,124.236.20.207,/admin,125.37.206.220,/config,125.76.247.185,/login,140.249.60.193,/admin

  • http_header1

    AAAAEAAAABtIb3N0OiBjb25uZWN0Lm1pY3Jvc29mdC5jb20AAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAEAAAAELnBocAAAAAUAAAAEZmlsZQAAAAkAAAALdGVzdDE9dGVzdDIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABtIb3N0OiBjb25uZWN0Lm1pY3Jvc29mdC5jb20AAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IGVuAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAABAAAADQAAAAUAAAAJdGVzdFBhcmFtAAAABwAAAAAAAAANAAAABQAAAAJpZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    GET

  • injection_process

  • jitter

    8448

  • maxdns

    0

  • month

    0

  • pipe_name

  • polling_time

    6000

  • port_number

    443

  • proxy_password

  • proxy_server

  • proxy_username

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCSc3AbKLaCH6+PeBGZHWHUFu9U23iqdiiL9LEJbtwz34ytpYPdlAtKipMfEysozCCk2RPQ4IqxdYcXMt0ss+IQxWDCnhAmrlAGBBe+kMLAkZUhBGs6maFW0QpXnakaA+jak/niNYYq2jWAIK8mK97mE9h9aXSGSwkYF2UOqqzzjQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    9.06174464e+08

  • unknown2

    AAAABAAAAAEAAAAIAAAAAQAAAAgAAAABAAAACgAAAAEAAAAGAAAAAQAAAAsAAAABAAAAIQAAAAEAAABFAAAAAQAAADcAAAABAAAAQwAAAAEAAAAbAAAAAQAAAA8AAAABAAAAGQAAAAEAAAAgAAAAAQAAAEgAAAACAAAAEAAAAAIAAAARAAAAAgAAAAsAAAACAAAAHwAAAAIAAABQAAAAAgAAADwAAAACAAAANgAAAAIAAABFAAAAAgAAACYAAAACAAAACAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • unknown4

    0

  • unknown5

    1.841236305e+09

  • uri

    /Admin

  • user_agent

    Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36

  • year

    0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1352

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1116-59-0x00000000767B1000-0x00000000767B3000-memory.dmp
        Download

        memory/1116-61-0x0000000000550000-0x000000000058D000-memory.dmp
        Download

        memory/1116-62-0x0000000000550000-0x000000000058D000-memory.dmp
        Download