Overview

overview

10

Static

static

88f7fe8fe6...27.exe

windows7-x64

10

88f7fe8fe6...27.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88f7fe8fe68d98400883978c509949d0ee5244ceee66a5c7099c36050dfc1727

  • Size

    501KB

  • Sample

    221126-n88sdscb66

  • MD5

    d21944dc08bafdc1570abe278633cc82

  • SHA1

    ea422f3c297cb8f5eddddbdb9252819a180a9a17

  • SHA256

    88f7fe8fe68d98400883978c509949d0ee5244ceee66a5c7099c36050dfc1727

  • SHA512

    62f3ee25edc1652b1b9d419782f62896b66dc94ad24797b3076b706a7f37731de442af2ba806d71ca4b642e532d1589a8ef7512a8165658bf732da040ecf9d1a

  • SSDEEP

    12288:d8CoMHybjto5+DAKkH103gEmFdfOB/dmHV:yCj5CJ

Score
10/10
cobaltstrikebackdoorbootkitpersistencetrojan

Malware Config

Targets

    • Target

      88f7fe8fe68d98400883978c509949d0ee5244ceee66a5c7099c36050dfc1727

    • Size

      501KB

    • MD5

      d21944dc08bafdc1570abe278633cc82

    • SHA1

      ea422f3c297cb8f5eddddbdb9252819a180a9a17

    • SHA256

      88f7fe8fe68d98400883978c509949d0ee5244ceee66a5c7099c36050dfc1727

    • SHA512

      62f3ee25edc1652b1b9d419782f62896b66dc94ad24797b3076b706a7f37731de442af2ba806d71ca4b642e532d1589a8ef7512a8165658bf732da040ecf9d1a

    • SSDEEP

      12288:d8CoMHybjto5+DAKkH103gEmFdfOB/dmHV:yCj5CJ

    Score
    10/10
    cobaltstrikebackdoorbootkitpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks