cobaltstrike | c6dc434f5a6ffb122a49b029f050d21986bdbb895c6b78babe467fbe1599119a | Triage

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 13:33

Sharing

Report Analysis Logs

General

Target

MicrosoftUpdates.exe
Size

1.3MB
MD5

4f5741e9cad4108ff416cdba20ce83a3
SHA1

63076e2bf03025eef97b9b7f458771c4f1bfe095
SHA256

c6dc434f5a6ffb122a49b029f050d21986bdbb895c6b78babe467fbe1599119a
SHA512

2e8336a152df04ba9bd9cf43a5f8ee61756be329a50cf7b5831d25a50e3ad01e70422ae7a25de890b8fcea6b5af0c688a360d294a20f4c9cf6f812556118063b
SSDEEP

24576:kET6UXC5icyL3dF+NZ7frNVD2oWj20Hgl+wl:kjX5K3eVab20Hgl+w

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://www.microsoft-cdn.cf:443/understand/tips/GMY0TY2G

Attributes

user_agent
Accept: application/xml, image/*, text/html Accept-Language: ca Accept-Encoding: *, br User-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 Host: www.microsoft-cdn.cf

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdates.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdates.exe"
1⤵
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1536-55-0x00000000293B0000-0x00000000297B0000-memory.dmp

Filesize
4.0MB

Download