cobaltstrike | c961cdc5324bc2a6803073994800c60067de9f3e541fae68b5a99543f6c76e14 | Triage

Analysis

max time kernel
116s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 02:40

Sharing

Report Analysis Logs

General

Target

1.exe
Size

17KB
MD5

d8fbdb2d7bcd3d822d26774e3c421334
SHA1

fec5b9f863781b9b489cf3847943d3790fd5d6fe
SHA256

c961cdc5324bc2a6803073994800c60067de9f3e541fae68b5a99543f6c76e14
SHA512

55c888a71c0d6b7171d8ebd163ba4df0b083ba72db30870538e8dd6cd70c4978ce2e4b75863f2da96cb3d743cbf9ea44733445652297779fa761e85bfe714038
SSDEEP

192:+DMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4iA54ZBUbOj6kxiY:+DMAoKz6WtKEj7aBDi5A5qbAY

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://66.151.208.233:443/Ew5l

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	2376	WerFault.exe	69

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 1128
  2⤵
  - Program crash
  PID:1116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 2376 -ip 2376
1⤵
PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-133-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2376-134-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download