Overview

overview

10

Static

static

10

c428ad6841...b7.exe

windows7-x64

10

c428ad6841...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c428ad6841f8f7887791a130ca090b6c42df8f2e6fbc3b5ec35ee1f497fd20b7

  • Size

    313KB

  • Sample

    221203-f9y1kshd88

  • MD5

    6a0f00c9e8eb7e2e0fbd485cbcc1c5cd

  • SHA1

    0b29457146c889531209dbf6e1ae941757110455

  • SHA256

    c428ad6841f8f7887791a130ca090b6c42df8f2e6fbc3b5ec35ee1f497fd20b7

  • SHA512

    431a47e7284440a4e027d11e9d71325313025fbbf65c37e10103d2ab1c8b520c4523c2f54d53fd0f44e7a2c3cb8edefeeadfebf59aded862af2c5057acc5f930

  • SSDEEP

    6144:SoKnaembZy9AGfeYc0gkF5Xf6QY/6cAuAQLh3++i2Wgwd:9KQA9b7XMD/naH

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Targets

    • Target

      c428ad6841f8f7887791a130ca090b6c42df8f2e6fbc3b5ec35ee1f497fd20b7

    • Size

      313KB

    • MD5

      6a0f00c9e8eb7e2e0fbd485cbcc1c5cd

    • SHA1

      0b29457146c889531209dbf6e1ae941757110455

    • SHA256

      c428ad6841f8f7887791a130ca090b6c42df8f2e6fbc3b5ec35ee1f497fd20b7

    • SHA512

      431a47e7284440a4e027d11e9d71325313025fbbf65c37e10103d2ab1c8b520c4523c2f54d53fd0f44e7a2c3cb8edefeeadfebf59aded862af2c5057acc5f930

    • SSDEEP

      6144:SoKnaembZy9AGfeYc0gkF5Xf6QY/6cAuAQLh3++i2Wgwd:9KQA9b7XMD/naH

    Score
    10/10
    cobaltstrikebackdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks