cobaltstrike | e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7

General

Target

e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
Size

2.5MB
MD5

09ad736dba1fffac4fd892dc49244846
SHA1

95f9f5b6fc9422f6737064d193d6d7f7c5c9247a
SHA256

e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7
SHA512

9d8bd2b7c44f4134d89c61c2cea6f4c415badcea7d6ae0bae2e8782c7690e3973a303764a3a87c9081573e8514c008392461ad0598780b638ed575e7b16a1132
SSDEEP

49152:cv6vFFVh1jrb/TdvO90d7HjmAFd4A64nsfJDpYasCvMp11ogl0OD8quwmmb1b8:H1whuJ

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe

pid	process
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe

description pid process

Token: SeDebugPrivilege 5040 e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe

description	pid	process
Token: SeDebugPrivilege	5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe

description	pid	process	target process
PID 5040 wrote to memory of 4876	5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe	notepad.exe
PID 5040 wrote to memory of 4876	5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe	notepad.exe
PID 5040 wrote to memory of 4876	5040	e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe
"C:\Users\Admin\AppData\Local\Temp\e7f06e7b08186cc868fafef4c4a85c29e120d49ea18c1100a899b337a5e1d7c7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe"
2⤵
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-132-0x000001B96FE70000-0x000001B96FEB1000-memory.dmp

Filesize
260KB

Download
memory/4876-133-0x0000000000000000-mapping.dmp

Download
memory/4876-134-0x000001B971990000-0x000001B971E02000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing