cobaltstrike | 42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547

General

Target

42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
Size

1.3MB
MD5

14aaa215e9b3c1e00fe200579b62096f
SHA1

ea7a115dbe99b2866dce2b4b528b42935b1ac0df
SHA256

42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547
SHA512

ae7ce435d31ead38001f3e990e3625955dfd9e6ed95e5d273fe22ddc3a92e582eea4432a78ffe1204e053ad04a1d0fa9c82480d37b0628afe627715c91ab5b6c
SSDEEP

24576:Uh5B4Gr+VacW7lICFGOuDv3bGEIzUfhIlyZxI:U7B7EzWP+3bSwXI

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3720-132-0x0000000000E70000-0x0000000001167000-memory.dmp	upx
behavioral2/memory/3720-133-0x0000000000E70000-0x0000000001167000-memory.dmp	upx
behavioral2/memory/3720-137-0x0000000000E70000-0x0000000001167000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe

pid	process
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe

description pid process

Token: SeDebugPrivilege 3720 42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe

description	pid	process
Token: SeDebugPrivilege	3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe

description	pid	process	target process
PID 3720 wrote to memory of 1636	3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe	notepad.exe
PID 3720 wrote to memory of 1636	3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe	notepad.exe
PID 3720 wrote to memory of 1636	3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe	notepad.exe
PID 3720 wrote to memory of 1636	3720	42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe
"C:\Users\Admin\AppData\Local\Temp\42eeb032eed8b27965b7fc971b1fd490310fc85fb5be3138675200075824e547.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe"
2⤵
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-134-0x00000203C74C0000-0x00000203C7501000-memory.dmp

Filesize
260KB

Download
memory/1636-135-0x0000000000000000-mapping.dmp

Download
memory/1636-136-0x00000203C8F30000-0x00000203C93A2000-memory.dmp

Filesize
4.4MB

Download
memory/3720-132-0x0000000000E70000-0x0000000001167000-memory.dmp

Filesize
3.0MB

Download
memory/3720-133-0x0000000000E70000-0x0000000001167000-memory.dmp

Filesize
3.0MB

Download
memory/3720-137-0x0000000000E70000-0x0000000001167000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads