Overview

overview

10

Static

static

b8cdcdba34...8b.exe

windows7_x64

10

b8cdcdba34...8b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    06-07-2022 02:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8cdcdba34d459c71acf26ec61bea1d938b2c9a845ec0351f26e749897228f8b.exe

  • Size

    1.4MB

  • MD5

    038e66a8e8d906da2fa1b8de904898af

  • SHA1

    d11a61021437fb4eb32d4c44b8967294363ab5bf

  • SHA256

    b8cdcdba34d459c71acf26ec61bea1d938b2c9a845ec0351f26e749897228f8b

  • SHA512

    0f796c97cd3009975711b98255e1865d85a99a07f05df01ba66e93c1fd0677b2e09777bb15655fd2d53926c7f8084de2526d64674c3968d33238acf70b4e9a08

Score
10/10
cobaltstrike0backdoorsuricatatrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • suricata: ET MALWARE Cobalt Strike Beacon Observed

    suricata: ET MALWARE Cobalt Strike Beacon Observed

    suricata
  • suricata: ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1

    suricata: ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1

    suricata
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8cdcdba34d459c71acf26ec61bea1d938b2c9a845ec0351f26e749897228f8b.exe
    "C:\Users\Admin\AppData\Local\Temp\b8cdcdba34d459c71acf26ec61bea1d938b2c9a845ec0351f26e749897228f8b.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3336-130-0x0000000000400000-0x0000000000592000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3336-131-0x0000000000400000-0x0000000000592000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3336-132-0x0000000000400000-0x0000000000592000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3336-133-0x0000000000400000-0x0000000000592000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3336-134-0x00000000043E0000-0x00000000047E0000-memory.dmp
    Filesize

    4.0MB

    Download
  • memory/3336-135-0x00000000047E0000-0x000000000482D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/3336-136-0x0000000000400000-0x0000000000592000-memory.dmp
    Filesize

    1.6MB

    Download