cobaltstrike | 4e7a06b20666a62613cca9f75ae58a35cfc5d721c05c8b435170a4e8024ba87e | Triage

Resubmissions

20-07-2023 06:12

230720-gyc5eadf7x 10

07-12-2022 01:02

221207-bdw4wsdf7t 10

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2023 06:12

Sharing

Report Analysis Logs

General

Target

/active_desktop_render_x64.dll
Size

13KB
MD5

802122880994c08598f9ab890a14656f
SHA1

398bdb1ddcb7cffa7706aedc09e117cc9286571a
SHA256

dd1bbf4398fa863265964364214440a7c2fb89ddd94a75aef501f48981e04eb0
SHA512

049a9411411f76bd22c6c4212735b8ab893cd24ddb995f863b1df7b23faedbccd7151ed62e2b4c763a92ebd0c1c5008392c9e75002c31c13eb3bee5bbde20937
SSDEEP

192:C603547TMTCmEwrm0iTC0g1ORZkBToGwQt7KxHDv3:c35403Ewf66OPkNLKx

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://service-5r35x0x0-1310046338.gz.apigw.tencentcs.com:443/result_78adc45.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2788 3904 WerFault.exe taskhostw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4780 wrote to memory of 3904	4780	rundll32.exe	taskhostw.exe
PID 4780 wrote to memory of 3904	4780	rundll32.exe	taskhostw.exe
PID 4780 wrote to memory of 3904	4780	rundll32.exe	taskhostw.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\\active_desktop_render_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\System32\taskhostw.exe
"C:\Windows\System32\taskhostw.exe"
2⤵
PID:3904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3904 -s 116
3⤵
- Program crash
PID:2788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 3904 -ip 3904
1⤵
PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3904-133-0x000001FF43840000-0x000001FF43841000-memory.dmp

Filesize
4KB

Download