cobaltstrike | c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
08-08-2022 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe
Size

412KB
MD5

91154a4d0b7bacfd53525a66a932f3fe
SHA1

9971101161b734ada1230f39879ef18406189ff2
SHA256

c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb
SHA512

523980b7f8d43b482f2346f61a8698a9f1b85d6ebae46e43ab3d94a48ed893b67ae8fea37053f4c948617a2e618acfa096314f7efc5d90f4eb606c4799c6b697

Score

10^/10

cobaltstrike 1 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://service-4j8u5xfz-1313036808.sh.apigw.tencentcs.com:443/passApi/html/_blank.html

Attributes

access_type
512
beacon_type
2048
host
service-4j8u5xfz-1313036808.sh.apigw.tencentcs.com,/passApi/html/_blank.html
http_header1
AAAACgAAABxVcGdyYWRlLUluc2VjdXJlLVJlcXVlc3RzOiAxAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAAFQU5JRD0AAAACAAAAGV9fU2VjdXJlLTNQQVBJU0lEPW5vc2tpbjsAAAABAAAAIztDT05TRU5UPVlFUytDTi56aC1DTisyMDIxMDkxNy0wOS0wAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOAAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAKAAAAGENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MAAAAAoAAAAfUmVmZXJlcjogaHR0cHM6Ly93d3cuYmFpZHUuY29tLwAAAAoAAAAcVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQAAAAcAAAAAAAAADQAAAAUAAAAIX19mb3JtaWQAAAAJAAAADmFwX2lkPWZrc2RVZEdXAAAACQAAABluZXdidXllcm5hbWU9bWJkWlNnSnZFR3BpAAAACQAAABZmaWVsZG5hbWU9RnNMS25hQ3VCdmVvAAAABwAAAAEAAAANAAAAAgAAAClhaWRfPTAwMDAwMDAwJmFjY3Zlcj0xJnNob3d0eXBlPWVtYmVkJnVhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
4864
polling_time
23000
port_number
443
sc_process32
%windir%\syswow64\gpupdate.exe
sc_process64
%windir%\sysnative\gpupdate.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsEmxfKMYC5LiUpKEMysDw5RhiFkIv7c6+EWluHiIuCfVd7tNDkMPj+o8rkg7TnhFLVceHaB33aSx/h0YQXJ6QLAldtmRN6iAYB+cfGhE/9B2LEllnHXyBEUiNoki/qP1JVMO8ohGBGMcGOWPgmPfkDthg0ObBvGVfzzXST0PX1wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.481970944e+09
unknown2
AAAABAAAAAEAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/v2/api/
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
watermark
1

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe

description	pid	process	target process
PID 1180 wrote to memory of 1916	1180	c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe	calc.exe
PID 1180 wrote to memory of 1916	1180	c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe	calc.exe
PID 1180 wrote to memory of 1916	1180	c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe	calc.exe
PID 1180 wrote to memory of 1916	1180	c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe
"C:\Users\Admin\AppData\Local\Temp\c01f48fd972e6d2eb3e54806db58191384ae33dc31c3470b624e44734c6024cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\System32\calc.exe
"C:\Windows\System32\calc.exe"
2⤵
PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-55-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download
memory/1916-56-0x000007FEFACC0000-0x000007FEFAD6C000-memory.dmp

Filesize
688KB

Download