cobaltstrike | ab0be423a7c0940154615c731074f4e09104501a338573dd3dde297445b52bbe

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab0be423a7c0940154615c731074f4e09104501a338573dd3dde297445b52bbe.dll
Size 687KB
Sample230720-lnjawsfg41
SHA256 ab0be423a7c0940154615c731074f4e09104501a338573dd3dde297445b52bbe
MD5 28e6011c2a4a975209a0e7a4881a5266
SHA1 8dfa65157fc14b54fc89696ad6a6022fce42d6f0
SHA512 1b6e892cb9b3425ac8afbae0ef3a4450438257c33cab630dfc6455226780161ddaddfb0a82095d8584a3f605ccad685597cd3e64e5a950b96f8a3fc706fc53d1
SSDEEP 6144:VNFNN0quA/N3zYXtrps4king/r2kYI7JvHM:VT0C/lws4king/r2ZIu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 0 305419896 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

http://185.162.235.61:80/fwlink

Attributes

access_type
512
host
185.162.235.61,/fwlink
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcsZBIeupBvTv1XFS17TKfvCpS1G4R35yenr0uhYON4par8SWqXcB2CyCwmtQnP22N2G9g7JZbM4d673Yjb5OW5WE77QV4Z4tOlQh+gj45HfOoZI+Z570/jIhnNiz8ltNriZj4XB1Nswis0ePPGY5ZhCvCBQ/udFDLlaAX2RUG0QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
watermark
305419896

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2220	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2548	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2548	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2548	2000	regsvr32.exe	28
PID 2548 wrote to memory of 2220	2548	cmd.exe	30
PID 2548 wrote to memory of 2220	2548	cmd.exe	30
PID 2548 wrote to memory of 2220	2548	cmd.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ab0be423a7c0940154615c731074f4e09104501a338573dd3dde297445b52bbe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\cmd.exe
  cmd.exe /c echo 1234567890 && ping -n 6 127.0.0.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\PING.EXE
    ping -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x00000000001A0000-0x00000000001E0000-memory.dmp

Download

memory/2000-55-0x0000000000570000-0x00000000005BC000-memory.dmp

Download

memory/2000-56-0x000000006BAC0000-0x000000006BB74000-memory.dmp

Download

memory/2000-57-0x0000000000570000-0x00000000005BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads