cobaltstrike | 94053dfbc06bc7124129dd51fabf67f7f3738109d6dc11d0b4bb785f0e93c0b6

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-en-20211208
submitted
12-01-2022 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ayfaga3.exe
Size

389KB
MD5

d053d4cd461951966e47ea44d28b42f8
SHA1

1ec4ce0b1379f951bc0fafcee15ac0945ab1beac
SHA256

94053dfbc06bc7124129dd51fabf67f7f3738109d6dc11d0b4bb785f0e93c0b6
SHA512

f132082ae13457c92a8b44bcd4bfb81bc07cb62e52a6ec89d6c17867a50bc0227f5ca4d813d516a446d9a6d1ec20ed69e611f8d44333916d0209ad7864217df3

Score

10^/10

cobaltstrike 1580103824 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1580103824

http://104.168.44.45:443/ptj

Attributes

access_type
512
beacon_type
2048
host
104.168.44.45,/ptj
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnCZHWnYFqYB/6gJdkc4MPDTtBJ20nkEAd3tsY4tPKs8MV4yIjJb5CtlrbKHjzP1oD/1AQsj6EKlEMFIKtakLx5+VybrMYE+dDdkDteHmVX0AeFyw001FyQVlt1B+OSNPRscKI5sh1L/ZdwnrMy6S6nNbQ5N5hls6k2kgNO5nQ7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)
watermark
1580103824

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Runs net.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Ayfaga3.exe

pid process

1276 Ayfaga3.exe

pid	process
1276	Ayfaga3.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

whoami.exe

description	pid	process
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe
Token: SeDebugPrivilege	524	whoami.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Ayfaga3.execmd.exenet.exe

description	pid	process	target process
PID 1276 wrote to memory of 524	1276	Ayfaga3.exe	whoami.exe
PID 1276 wrote to memory of 524	1276	Ayfaga3.exe	whoami.exe
PID 1276 wrote to memory of 524	1276	Ayfaga3.exe	whoami.exe
PID 1276 wrote to memory of 2028	1276	Ayfaga3.exe	cmd.exe
PID 1276 wrote to memory of 2028	1276	Ayfaga3.exe	cmd.exe
PID 1276 wrote to memory of 2028	1276	Ayfaga3.exe	cmd.exe
PID 2028 wrote to memory of 280	2028	cmd.exe	net.exe
PID 2028 wrote to memory of 280	2028	cmd.exe	net.exe
PID 2028 wrote to memory of 280	2028	cmd.exe	net.exe
PID 280 wrote to memory of 364	280	net.exe	net1.exe
PID 280 wrote to memory of 364	280	net.exe	net1.exe
PID 280 wrote to memory of 364	280	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\Ayfaga3.exe
"C:\Users\Admin\AppData\Local\Temp\Ayfaga3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\system32\whoami.exe
whoami /groups
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C net group "domain admins" /domain
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\net.exe
net group "domain admins" /domain
3⤵
- Suspicious use of WriteProcessMemory
PID:280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 group "domain admins" /domain
4⤵
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-287-0x0000000000000000-mapping.dmp

Download
memory/364-288-0x0000000000000000-mapping.dmp

Download
memory/524-285-0x0000000000000000-mapping.dmp

Download
memory/1276-55-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-56-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-57-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-59-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-58-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-60-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-61-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-73-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-107-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-118-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-117-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-116-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-115-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-114-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-113-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-112-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-111-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-110-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-109-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-108-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-106-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-105-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-104-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-103-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-102-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-101-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-100-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-99-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-98-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-97-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-96-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-95-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-94-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-93-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-92-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-91-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-90-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-89-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-88-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-87-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-86-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-85-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-84-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-83-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-82-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-81-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-80-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-79-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-78-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-77-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-76-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-75-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-74-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-72-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-71-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-70-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-69-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-68-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-67-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-66-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-65-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-64-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-63-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-62-0x0000000076B20000-0x0000000076B21000-memory.dmp

Filesize
4KB

Download
memory/1276-282-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1276-283-0x00000000002A0000-0x00000000002EE000-memory.dmp

Filesize
312KB

Download
memory/2028-286-0x0000000000000000-mapping.dmp

Download