cobaltstrike | c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72

General

Target

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
Size

495KB
MD5

4f3b1a2088e473c7d2373849deb4536f
SHA1

bed2fe1eb344a88c974def3d5afbb164501c2e9e
SHA256

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72
SHA512

c187eaecb3414f7434aaee88fdec25f52a629dca7997c2918ff84938f9aaa22ee14fd33c2a0ebc54d310f83d033731ef5ae8c57477dd0d05d702fc710c1f35fc

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1100 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

notepad.exe

pid process

2020 notepad.exe

flow	pid	process
5	1100	powershell.exe

pid	process
2020	notepad.exe

Drops startup file 1 IoCs

Processes:

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe

Loads dropped DLL 5 IoCs

Processes:

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe

pid	process
1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1100 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1100 powershell.exe

pid	process
1100	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1100	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exenotepad.exe

description	pid	process	target process
PID 1732 wrote to memory of 2020	1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 1732 wrote to memory of 2020	1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 1732 wrote to memory of 2020	1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 1732 wrote to memory of 2020	1732	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 2020 wrote to memory of 1100	2020	notepad.exe	powershell.exe
PID 2020 wrote to memory of 1100	2020	notepad.exe	powershell.exe
PID 2020 wrote to memory of 1100	2020	notepad.exe	powershell.exe
PID 2020 wrote to memory of 1100	2020	notepad.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
"C:\Users\Admin\AppData\Local\Temp\c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Roaming\13176\notepad.exe
"C:\Users\Admin\AppData\Roaming\13176\notepad.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" –NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\95E9.tmp\95EA.ps1
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95E9.tmp\95EA.ps1
MD5
70d220b78b4dce67312bed747623c9a2

SHA1
6be8d2146f963eee7552249210844296ee39ff09

SHA256
0d95b9500c0f06d65d620dc27d434d302229de8a3d995706ca50a08de1637327

SHA512
c13bf983ef5601a61a37f8f910496c2a6bf581d93cad95a74f5ef0bf6b9dcfbabf89d55a6563e80a799285edd267ac2a60564d9a1aad1e59b3994b64a8bd5c2f

Download Submit
C:\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
memory/1100-68-0x00000000003E2000-0x00000000003E4000-memory.dmp

Filesize
8KB

Download
memory/1100-67-0x00000000003E1000-0x00000000003E2000-memory.dmp

Filesize
4KB

Download
memory/1100-66-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1100-70-0x0000000004BE0000-0x0000000004C10000-memory.dmp

Filesize
192KB

Download
memory/1100-71-0x0000000004C10000-0x0000000004C50000-memory.dmp

Filesize
256KB

Download
memory/1732-55-0x0000000074F11000-0x0000000074F13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads