cobaltstrike | c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72

General

Target

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
Size

495KB
MD5

4f3b1a2088e473c7d2373849deb4536f
SHA1

bed2fe1eb344a88c974def3d5afbb164501c2e9e
SHA256

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72
SHA512

c187eaecb3414f7434aaee88fdec25f52a629dca7997c2918ff84938f9aaa22ee14fd33c2a0ebc54d310f83d033731ef5ae8c57477dd0d05d702fc710c1f35fc

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Executes dropped EXE 1 IoCs

Processes:

notepad.exe

pid process

2120 notepad.exe

pid	process
2120	notepad.exe

Drops startup file 1 IoCs

Processes:

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1352 powershell.exe
1352 powershell.exe
1352 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1352 powershell.exe

pid	process
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1352	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exenotepad.exe

description	pid	process	target process
PID 2352 wrote to memory of 2120	2352	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 2352 wrote to memory of 2120	2352	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 2352 wrote to memory of 2120	2352	c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe	notepad.exe
PID 2120 wrote to memory of 1352	2120	notepad.exe	powershell.exe
PID 2120 wrote to memory of 1352	2120	notepad.exe	powershell.exe
PID 2120 wrote to memory of 1352	2120	notepad.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe
"C:\Users\Admin\AppData\Local\Temp\c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Roaming\13176\notepad.exe
"C:\Users\Admin\AppData\Roaming\13176\notepad.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" –NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\B9B7.tmp\B9B8.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B9B7.tmp\B9B8.ps1
MD5
70d220b78b4dce67312bed747623c9a2

SHA1
6be8d2146f963eee7552249210844296ee39ff09

SHA256
0d95b9500c0f06d65d620dc27d434d302229de8a3d995706ca50a08de1637327

SHA512
c13bf983ef5601a61a37f8f910496c2a6bf581d93cad95a74f5ef0bf6b9dcfbabf89d55a6563e80a799285edd267ac2a60564d9a1aad1e59b3994b64a8bd5c2f

Download Submit
C:\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
C:\Users\Admin\AppData\Roaming\13176\notepad.exe
MD5
bfefedb094f40c276bf1ae26b225e310

SHA1
fb77c1744ef30303d35af75d355bc1eae28d459c

SHA256
e0bf50fbf1e666bad7c306dcfd26f389abd5af5bee37cfd94374a536771fa9b5

SHA512
e1fe7066f9ea0403805b168792d442611ae6b0424941865d1b01b8b837222fbe3105b98e54890ac660c9013b1281d27509d2a66b8dd0af8648fc3e6cd56e7131

Download Submit
memory/1352-294-0x0000000007DF0000-0x0000000007E56000-memory.dmp

Filesize
408KB

Download
memory/1352-290-0x00000000050C2000-0x00000000050C3000-memory.dmp

Filesize
4KB

Download
memory/1352-291-0x0000000007710000-0x0000000007D38000-memory.dmp

Filesize
6.2MB

Download
memory/1352-292-0x0000000007600000-0x0000000007622000-memory.dmp

Filesize
136KB

Download
memory/1352-293-0x0000000007FD0000-0x0000000008036000-memory.dmp

Filesize
408KB

Download
memory/1352-289-0x0000000004F50000-0x0000000004F86000-memory.dmp

Filesize
216KB

Download
memory/1352-295-0x0000000008040000-0x0000000008390000-memory.dmp

Filesize
3.3MB

Download
memory/1352-296-0x0000000007F80000-0x0000000007F9C000-memory.dmp

Filesize
112KB

Download
memory/1352-297-0x00000000083A0000-0x00000000083EB000-memory.dmp

Filesize
300KB

Download
memory/1352-298-0x00000000087D0000-0x0000000008846000-memory.dmp

Filesize
472KB

Download
memory/1352-288-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/1352-306-0x000000000A030000-0x000000000A6A8000-memory.dmp

Filesize
6.5MB

Download
memory/1352-307-0x0000000009550000-0x000000000956A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing