cobaltstrike | d559dfcb17855aa025e0c0991e862751f50660316ec6242f2aef11c625e92158 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20220414-en
submitted
05-07-2022 10:50

Sharing

Report Analysis Logs

General

Target

d559dfcb17855aa025e0c0991e862751f50660316ec6242f2aef11c625e92158.exe
Size

169KB
MD5

fd2ab16cefe743ee0dc95e6bd74e9cb2
SHA1

55d6fc1a8718b1ac7b077b24d4a8c99ae712f7cd
SHA256

d559dfcb17855aa025e0c0991e862751f50660316ec6242f2aef11c625e92158
SHA512

32cccf6e33ca58621440afb5a42601cf69c4edbad48e868fde6a7d4a54c7fe35d25413249634a1241bdd05e3ff587cd39eb4f0dfd6b75f02363026aa6f9c7388

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.168.133:443/Ru4b

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1708-54-0x000000013FD30000-0x000000013FDC6000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\d559dfcb17855aa025e0c0991e862751f50660316ec6242f2aef11c625e92158.exe
"C:\Users\Admin\AppData\Local\Temp\d559dfcb17855aa025e0c0991e862751f50660316ec6242f2aef11c625e92158.exe"
1⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-54-0x000000013FD30000-0x000000013FDC6000-memory.dmp

Filesize
600KB

Download
memory/1708-55-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1708-56-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Filesize
8KB

Download