Overview

overview

10

Static

static

405038bb90...19.exe

windows7-x64

10

405038bb90...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119

  • Size

    1.3MB

  • Sample

    221127-hj53bafg85

  • MD5

    f721d46e0049e7604741f53f79fe39a3

  • SHA1

    2bb22da15b74e26de1ffecb81583c403f1893257

  • SHA256

    405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119

  • SHA512

    89bcac2c72bddc50922381b0a92dcda4a1c2ee26dd8830393a983c19f804096792aa404ff786d5cc7928cae77c448c398c4606b6f869951f92e32931a933cfe3

  • SSDEEP

    24576:R0FGMqzFkMiE4nAcQB2kWf65NShgDAzkxFPh3kEpS:e+Fk+MHn6/SKDIkxxh3

Score
10/10
cobaltstrikemetasploitbackdoorpersistencetrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Targets

    • Target

      405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119

    • Size

      1.3MB

    • MD5

      f721d46e0049e7604741f53f79fe39a3

    • SHA1

      2bb22da15b74e26de1ffecb81583c403f1893257

    • SHA256

      405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119

    • SHA512

      89bcac2c72bddc50922381b0a92dcda4a1c2ee26dd8830393a983c19f804096792aa404ff786d5cc7928cae77c448c398c4606b6f869951f92e32931a933cfe3

    • SSDEEP

      24576:R0FGMqzFkMiE4nAcQB2kWf65NShgDAzkxFPh3kEpS:e+Fk+MHn6/SKDIkxxh3

    Score
    10/10
    cobaltstrikemetasploitbackdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks