cobaltstrike | e156869a450daa69fd996dffe2bae267ad9b7e003adf11fe9722c3de73abf2d1 | Triage

Analysis

max time kernel
186s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 08:55

Sharing

Report Analysis Logs

General

Target

goopdate.dll
Size

10.3MB
MD5

b29e90e9e588a4dceeeb937def15044e
SHA1

58ca25295d98c2ee1a4d71c7ec7177284b7d3fc3
SHA256

e156869a450daa69fd996dffe2bae267ad9b7e003adf11fe9722c3de73abf2d1
SHA512

99d65aba480381fe9ced19029e06d11f55ec4ee61b91c9f879798113f20c96cac1a8c20dfa6f9ab8d1f0be8d2ec9a1e987106d6948c676ee4cf4ced3391dbece
SSDEEP

196608:huWWWYWBWWW3W2WwWeW7WbWRWUWdWpW2WEWVWkWeW:huWWWYWBWWW3W2WwWeW7WbWRWUWdWpWU

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3300 wrote to memory of 4992	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 4992	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 4992	3300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goopdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goopdate.dll,#1
2⤵
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-132-0x0000000000000000-mapping.dmp

Download
memory/4992-133-0x00000000027F0000-0x0000000002822000-memory.dmp

Filesize
200KB

Download
memory/4992-134-0x0000000002830000-0x0000000002871000-memory.dmp

Filesize
260KB

Download