cobaltstrike | d6127d614309acbf2a630fe3fb0fda8e4079dcf2045f91aa400d179751d425f7

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-04-2023 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6127d614309acbf2a630fe3fb0fda8e4079dcf2045f91aa400d179751d425f7.dll
Size

547KB
MD5

76a1f94ed6499b99d2cc500998846875
SHA1

ca14d61bcf038cda45199f54c7c452ad262a7c88
SHA256

d6127d614309acbf2a630fe3fb0fda8e4079dcf2045f91aa400d179751d425f7
SHA512

a14383ae7d16e38a6db8a40181c560bd6c7ddc09515247efe21fd18996390867c26fbc55da60c43fa922757d6664259513c93b875fcaac85fb85a272712b3dde
SSDEEP

12288:jKbxbfwSq8PNouXG7Bo3qLgO8HeYU+MbGm:6xUSroIG7u3q8reYU+MbGm

Score

10^/10

cobaltstrike 0 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://msc-mvc-updates.com:80/_/scs/mail-static/_/js/

Attributes

access_type
512
host
msc-mvc-updates.com,/_/scs/mail-static/_/js/
http_header1
AAAABwAAAAAAAAADAAAAAgAAAAVPU0lEPQAAAAYAAAAGQ29va2llAAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAAZETlQ6IDEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACQAAAA11aT1kMzI0NGM0NzA3AAAACQAAAAtob3A9NjkyODYzMgAAAAkAAAAHc3RhcnQ9MAAAAAoAAAA9Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7Y2hhcnNldD11dGYtOAAAAAcAAAAAAAAAAwAAAAIAAAAFT1NJRD0AAAAGAAAABkNvb2tpZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
3840
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnOM3nXx+7HBhkbDd+AwFrFisSunK999w2tM0uTpuuEiBalcJhcL+QgQWtf6S7zPp5hjImG+2YcPl18geU4f5JlSPXHwilbK4DFb/ePWyKFjhrA7emVRqhM21QMlo1ANsn14rY/RO2pzuft8P7TXoIjjI/B2GGVuzYNZX6X4I2EwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
5.37071616e+08
unknown2
AAAABAAAAAEAAAF3AAAAAQAAAPoAAAACAAAABAAAAAIAAAAcAAAAAgAAACQAAAACAAAAEgAAAAIAAAAEAAAAAgAAABwAAAACAAAAJAAAAAIAAAARAAAAAgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/mail/u/0/
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)
watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 1404 rundll32.exe

flow	pid	process
4	1404	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6127d614309acbf2a630fe3fb0fda8e4079dcf2045f91aa400d179751d425f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6127d614309acbf2a630fe3fb0fda8e4079dcf2045f91aa400d179751d425f7.dll,#1
2⤵
- Blocklisted process makes network request
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-54-0x000000006BAC0000-0x000000006BB0D000-memory.dmp

Filesize
308KB

Download
memory/1404-62-0x000000006BAC0000-0x000000006BB0D000-memory.dmp

Filesize
308KB

Download
memory/1404-63-0x000000006BAC0000-0x000000006BB0D000-memory.dmp

Filesize
308KB

Download
memory/1404-64-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1404-66-0x0000000000840000-0x0000000000874000-memory.dmp

Filesize
208KB

Download
memory/1404-69-0x00000000008D0000-0x000000000090E000-memory.dmp

Filesize
248KB

Download
memory/1404-70-0x0000000062280000-0x0000000062302000-memory.dmp

Filesize
520KB

Download
memory/1404-71-0x00000000008D0000-0x000000000090E000-memory.dmp

Filesize
248KB

Download