cobaltstrike | 65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023

General

Target

65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
Size

2.5MB
MD5

47a8b1c08061485b03b9db5db4db3ba3
SHA1

2248168ba1c474f4d5fdcea5ac43892540d840fc
SHA256

65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023
SHA512

2535c80383c754511328be77b482a61b82f2f71bc22eb15b8b85c686d1059c2e2061e85fc53871470a81312c8e67613ade5ac7a563995fd444fe7a55619c167c
SSDEEP

49152:ca8yZ+zWx0Rrb/TWvO90d7HjmAFd4A64nsfJUtPSXCvMp11Lgl08Iussfb1M8:L0Tr5

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe

pid	process
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe

description pid process

Token: SeDebugPrivilege 2044 65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe

description	pid	process
Token: SeDebugPrivilege	2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe

description	pid	process	target process
PID 2044 wrote to memory of 4904	2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe	notepad.exe
PID 2044 wrote to memory of 4904	2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe	notepad.exe
PID 2044 wrote to memory of 4904	2044	65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe
"C:\Users\Admin\AppData\Local\Temp\65594d2429406070b93f7da2be61f9ebc0164acd97a309de3b8bf743744c9023.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe"
2⤵
PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4904-132-0x000002DC8BD30000-0x000002DC8BD71000-memory.dmp

Filesize
260KB

Download
memory/4904-133-0x0000000000000000-mapping.dmp

Download
memory/4904-134-0x000002DC8D970000-0x000002DC8DDE2000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing