cobaltstrike | c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6

General

Target

goopdate.dll
Size

285KB
MD5

3bb71cef8a643cf00aef4ed04a599b12
SHA1

bf8a77be54fffaca0775b2947e29b46959c010b9
SHA256

c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
SHA512

82f48dd1f2bab3cb53f9d0127f4dc53a247e5af05a1ae7b7f6271bf1676560305df726c72bd330a387edba86714bfe45b65029720b4faeaf1a10a905fe617a9e

Score

10^/10

cobaltstrike 305419896 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

C2

http://104.31.76.215:80/jquery-3.3.2.min.js

http://172.67.168.227:80/jquery-3.3.2.min.js

http://104.31.77.215:80/jquery-3.3.2.min.js

Attributes

access_type
512
dns_idle
1.34744072e+08
host
104.31.76.215,/jquery-3.3.2.min.js,172.67.168.227,/jquery-3.3.2.min.js,104.31.77.215,/jquery-3.3.2.min.js
http_header1
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAALc2Vzc2lvbl9pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IGVuAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAABAAAADQAAAAQAAAAHAAAAAAAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
8448
maxdns
245
polling_time
37500
port_number
80
sc_process32
%windir%\syswow64\ktmutil.exe
sc_process64
%windir%\sysnative\ktmutil.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCF0Hv1f5APRNApuC/MnRL8V04hCN5gcntJtYm48yXAuZipkyUXHpsUNi1S00duHZ26x62ObQ6fKvEZdG2JopO96tnwbsLSoKAU3ipseIA5tsNrdSWXIl7Gu6arE65eBecdkZ4t3s12EptaiwuoorSSP9rO9yQahF43hN6gsu5ZCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
9.45165568e+08
unknown2
AAAABAAAAAEAAABRAAAAAgAAAFQAAAACAAAAPQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/people/donald-j-trump
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
watermark
305419896

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

4 1524 rundll32.exe
5 1524 rundll32.exe

flow	pid	process
4	1524	rundll32.exe
5	1524	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1524	1608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goopdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goopdate.dll,#1
2⤵
- Blocklisted process makes network request
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/1524-56-0x0000000000260000-0x000000000029D000-memory.dmp

Filesize
244KB

Download
memory/1524-57-0x00000000001C0000-0x00000000001F4000-memory.dmp

Filesize
208KB

Download
memory/1524-58-0x0000000000260000-0x000000000029D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing