cobaltstrike | 963cacd7eeebfb09950668bf1c6adf5452b992fc09119835cd256c5d3cf17f91 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Xfourk19_browsingExe.dll
Size

106KB
MD5

e70d2f9258a0f784bdc3bd52e75a68bb
SHA1

cb17fb4e8428cad71bef5123bd487d77449fcb80
SHA256

963cacd7eeebfb09950668bf1c6adf5452b992fc09119835cd256c5d3cf17f91
SHA512

ab75a8b7e13eb40271326280f45e6041f12654b1bd9522249f396a1fbb120b4d6fcc8cedeef699fbaf7c5ffdda9883ef7c788299e274488a68990820ad69c409
SSDEEP

1536:SFJvJrURWA2/Xk/3d9nyFjshbrY03tFYwnv70ktqvyocqBA:grUM3I9pFFYSrtZwA

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://208.87.129.179:843/c/msdownload/update/others/2020/10/29136389_

Attributes

user_agent
Accept: */* Host: download.windowsupdate.com User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.40

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 10 IoCs

flow	pid	Process
1	4192	rundll32.exe
10	4192	rundll32.exe
16	4192	rundll32.exe
17	4192	rundll32.exe
18	4192	rundll32.exe
19	4192	rundll32.exe
26	4192	rundll32.exe
27	4192	rundll32.exe
28	4192	rundll32.exe
29	4192	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4692	4192	WerFault.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xfourk19_browsingExe.dll,#1
1⤵
- Blocklisted process makes network request
PID:4192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4192 -s 1104
  2⤵
  - Program crash
  PID:4692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 4192 -ip 4192
1⤵
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4192-133-0x0000017449880000-0x0000017449881000-memory.dmp

Filesize
4KB

Download
memory/4192-135-0x00007FFAE4650000-0x00007FFAE4672000-memory.dmp

Filesize
136KB

Download