cobaltstrike | 3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3

General

Target

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
Size

3.5MB
MD5

5868d5f4553d09e0cec3ac99e5627a02
SHA1

8d770dc0933e355b02aace86e7231b4bf437af1a
SHA256

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3
SHA512

92769d31ef11c83c0e87307dca29d38a41a521dfb89e3ef521c7c34c78fc14b718a787417fee463bb68a10f249af5fb043a7596cb451e26d3b9b6ae81a4cfbe5

Score

10^/10

cobaltstrike metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

pid process

1272 3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
Loads dropped DLL 1 IoCs

Processes:

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

pid process

1000 3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

pid	process
1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

pid	process
1272	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
1272	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

description	pid	process	target process
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
PID 1000 wrote to memory of 1272	1000	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe	3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe

C:\Users\Admin\AppData\Local\Temp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
"C:\Users\Admin\AppData\Local\Temp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000

C:\Users\Admin\AppData\Local\Temp\jds7098903.tmp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
"C:\Users\Admin\AppData\Local\Temp\jds7098903.tmp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jds7098903.tmp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
Filesize
1.5MB

MD5
736e3f5f865d0ae2deabd5f57c4a67b9

SHA1
9da9afd4df6db19f8539f96749cf3b9d4ab02f44

SHA256
3d6b1f366b653c83213528c9d120cb0bcf736cb2f0fa92622995fce93ae18921

SHA512
79139528ef892979398080844c86ebf43a10ad60c70461149659a139cd1140e061ed26de9606de0e54362761363de93fa74b6c1f1867dbf8adeab3e32348f433

Download Submit
C:\Users\Admin\AppData\Local\Temp\jds7098903.tmp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
Filesize
1.5MB

MD5
736e3f5f865d0ae2deabd5f57c4a67b9

SHA1
9da9afd4df6db19f8539f96749cf3b9d4ab02f44

SHA256
3d6b1f366b653c83213528c9d120cb0bcf736cb2f0fa92622995fce93ae18921

SHA512
79139528ef892979398080844c86ebf43a10ad60c70461149659a139cd1140e061ed26de9606de0e54362761363de93fa74b6c1f1867dbf8adeab3e32348f433

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
1KB

MD5
9dc7a2c62d1da397dd4ea294cbbb13ba

SHA1
b55f829d73b1dfdfe1d8aad753c4c3f3e16a8a35

SHA256
327bcfa8161b029265b3c1f788a255381a2096c7890366dd207bcfe04bb56b7a

SHA512
9fae708611e3c58606466f3538742468fc3d930143cf1fbcfccaa47e914c097a600f7fc5f08aa7e6893d429a2c999013466f04c58468a7922c047efdb14a1e24

Download Submit
\Users\Admin\AppData\Local\Temp\jds7098903.tmp\3b664ef693e3a2ba0d802e3533665deeb5b6564b60b9df77ddf7b5238c5433b3.exe
Filesize
1.5MB

MD5
736e3f5f865d0ae2deabd5f57c4a67b9

SHA1
9da9afd4df6db19f8539f96749cf3b9d4ab02f44

SHA256
3d6b1f366b653c83213528c9d120cb0bcf736cb2f0fa92622995fce93ae18921

SHA512
79139528ef892979398080844c86ebf43a10ad60c70461149659a139cd1140e061ed26de9606de0e54362761363de93fa74b6c1f1867dbf8adeab3e32348f433

Download Submit
memory/1000-58-0x0000000000400000-0x000000000078AF18-memory.dmp

Filesize
3.5MB

Download
memory/1000-59-0x00000000008D0000-0x0000000000901000-memory.dmp

Filesize
196KB

Download
memory/1272-55-0x0000000000000000-mapping.dmp

Download
memory/1272-57-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads