cobaltstrike | 9a55a663051c0fa0834a6197322a80713b285eacb6d0181328733340e8c467bc

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2023 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1c692cf0614c4e0a688cd3e87b78d12.exe
Size

9.0MB
MD5

d1c692cf0614c4e0a688cd3e87b78d12
SHA1

65756ca25f579f8c9896144d6315f590113a3927
SHA256

0a85b3109591406eb3f28ad604c8ca099a141612d51583a05757a41a894ec4e0
SHA512

ea5592fd011ebea66e7e0b7446e4006576106d1e8af571771e577e2a9e8854dcd9d7bfe2317383a6fd94372e770dd1671f87372d9598a3bdc8ee9437139dbb27
SSDEEP

196608:XpwZC6c45SyY+GOe42yOmL2Vmd6+Dfc/f/+SmpsEVRadR+yDp:5+nSyY+k4tOmL2Vmd6mfc/ebpnRiBp

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://192.168.179.128:80/ciGJ

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Loads dropped DLL 14 IoCs

Processes:

d1c692cf0614c4e0a688cd3e87b78d12.exe

pid	process
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe
1768	d1c692cf0614c4e0a688cd3e87b78d12.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

d1c692cf0614c4e0a688cd3e87b78d12.exe

description	pid	process	target process
PID 2960 wrote to memory of 1768	2960	d1c692cf0614c4e0a688cd3e87b78d12.exe	d1c692cf0614c4e0a688cd3e87b78d12.exe
PID 2960 wrote to memory of 1768	2960	d1c692cf0614c4e0a688cd3e87b78d12.exe	d1c692cf0614c4e0a688cd3e87b78d12.exe

C:\Users\Admin\AppData\Local\Temp\d1c692cf0614c4e0a688cd3e87b78d12.exe
"C:\Users\Admin\AppData\Local\Temp\d1c692cf0614c4e0a688cd3e87b78d12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Users\Admin\AppData\Local\Temp\d1c692cf0614c4e0a688cd3e87b78d12.exe
"C:\Users\Admin\AppData\Local\Temp\d1c692cf0614c4e0a688cd3e87b78d12.exe"
2⤵
- Loads dropped DLL
PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29602\VCRUNTIME140.dll
Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\VCRUNTIME140.dll
Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_cffi_backend.cp310-win_amd64.pyd
Filesize
177KB

MD5
6f1b90884343f717c5dc14f94ef5acea

SHA1
cca1a4dcf7a32bf698e75d58c5f130fb3572e423

SHA256
2093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1

SHA512
e2c673b75162d3432bab497bad3f5f15a9571910d25f1dffb655755c74457ac78e5311bd5b38d29a91aec4d3ef883ae5c062b9a3255b5800145eb997863a7d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_cffi_backend.cp310-win_amd64.pyd
Filesize
177KB

MD5
6f1b90884343f717c5dc14f94ef5acea

SHA1
cca1a4dcf7a32bf698e75d58c5f130fb3572e423

SHA256
2093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1

SHA512
e2c673b75162d3432bab497bad3f5f15a9571910d25f1dffb655755c74457ac78e5311bd5b38d29a91aec4d3ef883ae5c062b9a3255b5800145eb997863a7d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_ctypes.pyd
Filesize
119KB

MD5
87596db63925dbfe4d5f0f36394d7ab0

SHA1
ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

SHA256
92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

SHA512
e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_ctypes.pyd
Filesize
119KB

MD5
87596db63925dbfe4d5f0f36394d7ab0

SHA1
ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

SHA256
92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

SHA512
e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_hashlib.pyd
Filesize
60KB

MD5
49ce7a28e1c0eb65a9a583a6ba44fa3b

SHA1
dcfbee380e7d6c88128a807f381a831b6a752f10

SHA256
1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

SHA512
cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_hashlib.pyd
Filesize
60KB

MD5
49ce7a28e1c0eb65a9a583a6ba44fa3b

SHA1
dcfbee380e7d6c88128a807f381a831b6a752f10

SHA256
1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

SHA512
cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_socket.pyd
Filesize
75KB

MD5
e137df498c120d6ac64ea1281bcab600

SHA1
b515e09868e9023d43991a05c113b2b662183cfe

SHA256
8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

SHA512
cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_socket.pyd
Filesize
75KB

MD5
e137df498c120d6ac64ea1281bcab600

SHA1
b515e09868e9023d43991a05c113b2b662183cfe

SHA256
8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

SHA512
cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\base_library.zip
Filesize
1.0MB

MD5
17cf5f24a63ba513f85412379ec05d8a

SHA1
b1a14503e26161e49017f52fdd6e7afe039e0c09

SHA256
fb2d5825818e463e27cb94d44dd5a2a50c801b5450c107019a158f3e7f24b7a7

SHA512
4a03e61e0ad696e729a23cb7fc2f678c5c0546102746fdbc155db78a1df29abdf7d5823444fbbb3df8e26bd2f669f4f541f116d2450a914470f1862fb1cfdc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\cryptography\hazmat\bindings\_openssl.pyd
Filesize
3.8MB

MD5
8a4c69aad3c6201aad1d90033dd96c71

SHA1
7e5bb5e1d0058edb094fe52a1427f1e4ea0be2e0

SHA256
5934a69a8f0535e3efd99268d894ae52d9aa70118a5ffeba3e2fe4fafce4b464

SHA512
049debc29f618e4dbccb8d395b9f0c39f2ac9919f938efba28903f95020a5018d13a9a2bdf3a256e4f6c57259195db66a161a5290abbdb3b6760652817bcfe22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\cryptography\hazmat\bindings\_openssl.pyd
Filesize
3.8MB

MD5
8a4c69aad3c6201aad1d90033dd96c71

SHA1
7e5bb5e1d0058edb094fe52a1427f1e4ea0be2e0

SHA256
5934a69a8f0535e3efd99268d894ae52d9aa70118a5ffeba3e2fe4fafce4b464

SHA512
049debc29f618e4dbccb8d395b9f0c39f2ac9919f938efba28903f95020a5018d13a9a2bdf3a256e4f6c57259195db66a161a5290abbdb3b6760652817bcfe22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\cryptography\hazmat\bindings\_rust.pyd
Filesize
1.6MB

MD5
42be859198de417f5c3b92d9aefe526a

SHA1
5d7eeec96e7f49bc52521ae5d7b4561278017edc

SHA256
e9b319f3ae9d84279c5e8275b9795c69685d3448d633de94c824a8120336e011

SHA512
67243591f1a546bb8b4d92f8cefef290fd644071ea1666dac0ea4dcb25800f5925e39e0f5fcebbd8bb2b1a468be1a46885fc9f0a4c6292a6ee625423a2d9d40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\cryptography\hazmat\bindings\_rust.pyd
Filesize
1.6MB

MD5
42be859198de417f5c3b92d9aefe526a

SHA1
5d7eeec96e7f49bc52521ae5d7b4561278017edc

SHA256
e9b319f3ae9d84279c5e8275b9795c69685d3448d633de94c824a8120336e011

SHA512
67243591f1a546bb8b4d92f8cefef290fd644071ea1666dac0ea4dcb25800f5925e39e0f5fcebbd8bb2b1a468be1a46885fc9f0a4c6292a6ee625423a2d9d40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libcrypto-1_1.dll
Filesize
3.3MB

MD5
ab01c808bed8164133e5279595437d3d

SHA1
0f512756a8db22576ec2e20cf0cafec7786fb12b

SHA256
9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

SHA512
4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libcrypto-1_1.dll
Filesize
3.3MB

MD5
ab01c808bed8164133e5279595437d3d

SHA1
0f512756a8db22576ec2e20cf0cafec7786fb12b

SHA256
9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

SHA512
4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\python3.DLL
Filesize
63KB

MD5
07bd9f1e651ad2409fd0b7d706be6071

SHA1
dfeb2221527474a681d6d8b16a5c378847c59d33

SHA256
5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

SHA512
def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\python3.dll
Filesize
63KB

MD5
07bd9f1e651ad2409fd0b7d706be6071

SHA1
dfeb2221527474a681d6d8b16a5c378847c59d33

SHA256
5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

SHA512
def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\python3.dll
Filesize
63KB

MD5
07bd9f1e651ad2409fd0b7d706be6071

SHA1
dfeb2221527474a681d6d8b16a5c378847c59d33

SHA256
5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

SHA512
def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\select.pyd
Filesize
28KB

MD5
adc412384b7e1254d11e62e451def8e9

SHA1
04e6dff4a65234406b9bc9d9f2dcfe8e30481829

SHA256
68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

SHA512
f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\select.pyd
Filesize
28KB

MD5
adc412384b7e1254d11e62e451def8e9

SHA1
04e6dff4a65234406b9bc9d9f2dcfe8e30481829

SHA256
68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

SHA512
f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\ucrtbase.dll
Filesize
1002KB

MD5
298e85be72551d0cdd9ed650587cfdc6

SHA1
5a82bcc324fb28a5147b4e879b937fb8a56b760c

SHA256
eb89af5911a60d892a685181c397d32b72c61dc2ad77dd45b8cac0fbb7602b84

SHA512
3fafea5ff0d0b4e07f6354c37b367ada4da1b607186690c732364518a93c3fd2f5004014c9c3d23dde28db87d1cb9ae1259cda68b9ba757db59a59d387ac4e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\ucrtbase.dll
Filesize
1002KB

MD5
298e85be72551d0cdd9ed650587cfdc6

SHA1
5a82bcc324fb28a5147b4e879b937fb8a56b760c

SHA256
eb89af5911a60d892a685181c397d32b72c61dc2ad77dd45b8cac0fbb7602b84

SHA512
3fafea5ff0d0b4e07f6354c37b367ada4da1b607186690c732364518a93c3fd2f5004014c9c3d23dde28db87d1cb9ae1259cda68b9ba757db59a59d387ac4e02

Download Submit
memory/1768-228-0x000001919E080000-0x000001919E081000-memory.dmp

Filesize
4KB

Download