Overview

overview

10

Static

static

championship.inf.dll

windows7_x64

10

championship.inf.dll

windows10_x64

10

Resubmissions

15/09/2021, 06:42

210915-hgtlhadaer10

14/09/2021, 08:06

210914-jzwz1sacfj10

10/09/2021, 11:57

210910-n4w8ssdbdp10

08/09/2021, 11:10

210908-m965hshefk10

Sharing

Copy URL Twitter E-mail

General

  • Target
    championship.inf
  • Size 2.0MB
  • Sample210908-m965hshefk
  • SHA256 6eedf45cb91f6762de4e35e36bcb03e5ad60ce9ac5a08caeb7eda035cd74762b
  • MD5 SHA1 SHA512
Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://dodefoh.com:443/static-directory/media.gif

Attributes
  • user_agent

    Host: microsoft.com Connection: close Accept-Encoding: br Accept-Language: en-US User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9

Targets

    • Target
      championship.inf
    • Size 2.0MB
    • SHA256 6eedf45cb91f6762de4e35e36bcb03e5ad60ce9ac5a08caeb7eda035cd74762b
    • MD5 SHA1 SHA512
    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Blocklisted process makes network request

    • Deletes itself

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks