Overview

overview

10

Static

static

10

b5e6f527c4...ba.exe

windows7-x64

10

b5e6f527c4...ba.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5e6f527c4ad3f6173ed65c9f2abf356ad66f15d1f742edf8d677c4e85222bba

  • Size

    312KB

  • Sample

    221204-yf95vsad44

  • MD5

    ff4518fc827203266647281a775acce2

  • SHA1

    79bc27da4c8c9a4272b2de04324924d01e412ff6

  • SHA256

    b5e6f527c4ad3f6173ed65c9f2abf356ad66f15d1f742edf8d677c4e85222bba

  • SHA512

    3bbf3084fcf1de18f9063cf1cb553edd3dcbc7023460d239818e67e8e88b6bf3a61c0d64498da60abecf37a381653ab56b8edb46ee5b349269f8c7a302085d29

  • SSDEEP

    6144:I+1VyBhl40pPMMHLdL1hALe+2NirdrQdZKwUKD05d:IEyt4wMMdoLT2NKccwG

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Targets

    • Target

      b5e6f527c4ad3f6173ed65c9f2abf356ad66f15d1f742edf8d677c4e85222bba

    • Size

      312KB

    • MD5

      ff4518fc827203266647281a775acce2

    • SHA1

      79bc27da4c8c9a4272b2de04324924d01e412ff6

    • SHA256

      b5e6f527c4ad3f6173ed65c9f2abf356ad66f15d1f742edf8d677c4e85222bba

    • SHA512

      3bbf3084fcf1de18f9063cf1cb553edd3dcbc7023460d239818e67e8e88b6bf3a61c0d64498da60abecf37a381653ab56b8edb46ee5b349269f8c7a302085d29

    • SSDEEP

      6144:I+1VyBhl40pPMMHLdL1hALe+2NirdrQdZKwUKD05d:IEyt4wMMdoLT2NKccwG

    Score
    10/10
    cobaltstrikebackdoorpersistencetrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks