cobaltstrike | dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

General

Target

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe
Size

2.5MB
MD5

b70608c6a2c35914470fba5b0b91cd61
SHA1

43820909b30fac5c57ee4cf38790e7af75cdb18c
SHA256

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe
SHA512

d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://139.196.112.7:80/l2xG

Attributes

user_agent
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Executes dropped EXE 2 IoCs

Processes:

UpdateInstaller_498081.exeUpdateInstaller_498081.exe

pid process

1136 UpdateInstaller_498081.exe
816 UpdateInstaller_498081.exe
Loads dropped DLL 5 IoCs

Processes:

taskeng.exe

pid process

1976 taskeng.exe
1976 taskeng.exe
1872
1976 taskeng.exe
608

pid	process
1136	UpdateInstaller_498081.exe
816	UpdateInstaller_498081.exe

pid	process
1976	taskeng.exe
1976	taskeng.exe
1872
1976	taskeng.exe
608

Drops file in System32 directory 1 IoCs

Processes:

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe

description	ioc	process
File opened for modification	\??\c:\windows\system32\UpdateInstaller_498081.exe	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

1948 SCHTASKS.exe

pid	process
1948	SCHTASKS.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exetaskeng.exe

description	pid	process	target process
PID 1808 wrote to memory of 1948	1808	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe	SCHTASKS.exe
PID 1808 wrote to memory of 1948	1808	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe	SCHTASKS.exe
PID 1808 wrote to memory of 1948	1808	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe	SCHTASKS.exe
PID 1976 wrote to memory of 1136	1976	taskeng.exe	UpdateInstaller_498081.exe
PID 1976 wrote to memory of 1136	1976	taskeng.exe	UpdateInstaller_498081.exe
PID 1976 wrote to memory of 1136	1976	taskeng.exe	UpdateInstaller_498081.exe
PID 1976 wrote to memory of 816	1976	taskeng.exe	UpdateInstaller_498081.exe
PID 1976 wrote to memory of 816	1976	taskeng.exe	UpdateInstaller_498081.exe
PID 1976 wrote to memory of 816	1976	taskeng.exe	UpdateInstaller_498081.exe

C:\Users\Admin\AppData\Local\Temp\dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe
"C:\Users\Admin\AppData\Local\Temp\dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\system32\SCHTASKS.exe
SCHTASKS /Create /sc minute /mo 1 /tn MicrosoftUpdateW /tr \"C:\windows\system32\UpdateInstaller_498081.exe\" /f
2⤵
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\taskeng.exe
taskeng.exe {9245BA50-559B-4CD1-9A50-4B1179B88E0D} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976

C:\windows\system32\UpdateInstaller_498081.exe
C:\windows\system32\UpdateInstaller_498081.exe
2⤵
- Executes dropped EXE
PID:1136

C:\windows\system32\UpdateInstaller_498081.exe
C:\windows\system32\UpdateInstaller_498081.exe
2⤵
- Executes dropped EXE
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
C:\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
C:\windows\system32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
memory/816-63-0x0000000000000000-mapping.dmp

Download
memory/1136-58-0x0000000000000000-mapping.dmp

Download
memory/1136-61-0x000007FEFB671000-0x000007FEFB673000-memory.dmp

Filesize
8KB

Download
memory/1948-54-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads