cobaltstrike | 963cacd7eeebfb09950668bf1c6adf5452b992fc09119835cd256c5d3cf17f91 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Xfourk19_browsingExe.dll
Size

106KB
MD5

e70d2f9258a0f784bdc3bd52e75a68bb
SHA1

cb17fb4e8428cad71bef5123bd487d77449fcb80
SHA256

963cacd7eeebfb09950668bf1c6adf5452b992fc09119835cd256c5d3cf17f91
SHA512

ab75a8b7e13eb40271326280f45e6041f12654b1bd9522249f396a1fbb120b4d6fcc8cedeef699fbaf7c5ffdda9883ef7c788299e274488a68990820ad69c409
SSDEEP

1536:SFJvJrURWA2/Xk/3d9nyFjshbrY03tFYwnv70ktqvyocqBA:grUM3I9pFFYSrtZwA

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://208.87.129.179:843/c/msdownload/update/others/2020/10/29136389_

Attributes

user_agent
Accept: */* Host: download.windowsupdate.com User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.40

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 20 IoCs

flow	pid	Process
3	2592	rundll32.exe
5	2592	rundll32.exe
6	2592	rundll32.exe
7	2592	rundll32.exe
8	2592	rundll32.exe
9	2592	rundll32.exe
11	2592	rundll32.exe
12	2592	rundll32.exe
13	2592	rundll32.exe
14	2592	rundll32.exe
15	2592	rundll32.exe
16	2592	rundll32.exe
18	2592	rundll32.exe
19	2592	rundll32.exe
20	2592	rundll32.exe
21	2592	rundll32.exe
22	2592	rundll32.exe
23	2592	rundll32.exe
25	2592	rundll32.exe
26	2592	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xfourk19_browsingExe.dll,#1
1⤵
- Blocklisted process makes network request
PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-53-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2592-55-0x000007FEF7C70000-0x000007FEF7C92000-memory.dmp

Filesize
136KB

Download