Overview

overview

10

Static

static

10

rundll32.exe

windows7_x64

10

rundll32.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rundll32.exe

  • Size

    72KB

  • Sample

    220523-t7xlmaaeap

  • MD5

    0ae6801746fc951ea748bd6fcebd7ea4

  • SHA1

    154145167949420056d7a1566740ff99b2765199

  • SHA256

    cbae182671c1d12bb0f548ff686b68101704751a1b592a12482a3526ae043558

  • SHA512

    6bc8f76711f0a0a85327a4b57a50cd2cdc47de0419d7bd4971a0db7fedcb572b8bb698620367ee331a38a37345ec261ea1956e66f406eb64f4544fcf87454572

Score
10/10
cobaltstrikemetasploitbackdoorpersistencetrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.19.130.43:14610

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Targets

    • Target

      rundll32.exe

    • Size

      72KB

    • MD5

      0ae6801746fc951ea748bd6fcebd7ea4

    • SHA1

      154145167949420056d7a1566740ff99b2765199

    • SHA256

      cbae182671c1d12bb0f548ff686b68101704751a1b592a12482a3526ae043558

    • SHA512

      6bc8f76711f0a0a85327a4b57a50cd2cdc47de0419d7bd4971a0db7fedcb572b8bb698620367ee331a38a37345ec261ea1956e66f406eb64f4544fcf87454572

    Score
    10/10
    cobaltstrikemetasploitbackdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies boot configuration data using bcdedit

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks