cobaltstrike | dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

General

Target

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe
Size

2.5MB
MD5

b70608c6a2c35914470fba5b0b91cd61
SHA1

43820909b30fac5c57ee4cf38790e7af75cdb18c
SHA256

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe
SHA512

d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://139.196.112.7:80/l2xG

Attributes

user_agent
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Executes dropped EXE 2 IoCs

Processes:

UpdateInstaller_498081.exeUpdateInstaller_498081.exe

pid process

2328 UpdateInstaller_498081.exe
2668 UpdateInstaller_498081.exe

pid	process
2328	UpdateInstaller_498081.exe
2668	UpdateInstaller_498081.exe

Drops file in System32 directory 1 IoCs

Processes:

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe

description	ioc	process
File opened for modification	\??\c:\windows\system32\UpdateInstaller_498081.exe	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

2152 SCHTASKS.exe

pid	process
2152	SCHTASKS.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe

description	pid	process	target process
PID 4608 wrote to memory of 2152	4608	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe	SCHTASKS.exe
PID 4608 wrote to memory of 2152	4608	dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe	SCHTASKS.exe

C:\Users\Admin\AppData\Local\Temp\dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe
"C:\Users\Admin\AppData\Local\Temp\dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\system32\SCHTASKS.exe
SCHTASKS /Create /sc minute /mo 1 /tn MicrosoftUpdateW /tr \"C:\windows\system32\UpdateInstaller_498081.exe\" /f
2⤵
- Creates scheduled task(s)
PID:2152

C:\windows\system32\UpdateInstaller_498081.exe
C:\windows\system32\UpdateInstaller_498081.exe
1⤵
- Executes dropped EXE
PID:2328

C:\windows\system32\UpdateInstaller_498081.exe
C:\windows\system32\UpdateInstaller_498081.exe
1⤵
- Executes dropped EXE
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
C:\Windows\System32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
C:\windows\system32\UpdateInstaller_498081.exe
Filesize
2.5MB

MD5
b70608c6a2c35914470fba5b0b91cd61

SHA1
43820909b30fac5c57ee4cf38790e7af75cdb18c

SHA256
dc59a99152d6a326c32337cfece84ac3ac232d370b5f7051bcf02f274e8358fe

SHA512
d5ef559ab8a85b76b3d2e0e32bc28dacea6136a9de405b612c601a9d7769dbe7955831ae96bf9216a8bf13cbad01c96239b8958cc6f7bd0045e9f519e95fdf0a

Download Submit
memory/2152-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads