cobaltstrike | 0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36

Analysis

max time kernel
142s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36.exe
Size

1.6MB
MD5

173bf153f862d14dbbd5d49f67adff2a
SHA1

c7e2ead199a3de4daaa80f1dc3633b2f75fefb07
SHA256

0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36
SHA512

ca866e2f82d1f440b022958fdae77e8f765a4f98badd00e74d12badc564223fbff7d9f81c67d92c0c61b98e216a1bac77d6383ed9de91a56b886ccc0829be098
SSDEEP

49152:/uWOlqAQl4MK1pIMxLGYoaTjXUFbLSOzzYqbk7s5q:/uWOAfBK/I6LhjabLSOzMqBq

Score

10^/10

cobaltstrike 0 305419896 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

http://172.26.168.129:16026/dot.gif

Attributes

access_type
512
host
172.26.168.129,/dot.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
16026
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTUlJ7J79z/MkkV8+MsYlOvREE2hhdGNzrKPFZ10lY0K5legA+um5JxESEaC0woDgSmOGrkh1giz/aQwd6tG4mihFgpi0oIbfwu6XZbE6ghYGyu2F7+A5TifRUzvU0YLXjK78EW12XhjHx4KopMF/AtOAueGwfiI2DmXwNzrBDvwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
watermark
305419896

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Executes dropped EXE 1 IoCs

Processes:

beacon.exe

pid process

3848 beacon.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3848	beacon.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36.exe

description	pid	process	target process
PID 4868 wrote to memory of 3848	4868	0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36.exe	beacon.exe
PID 4868 wrote to memory of 3848	4868	0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36.exe	beacon.exe

C:\Users\Admin\AppData\Local\Temp\0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36.exe
"C:\Users\Admin\AppData\Local\Temp\0a3d4b4007ca57d3b5813fae7d323a7fb9fb646068aceecbf44fe950ae721c36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868

C:\Users\Public\beacon.exe
"C:\Users\Public\beacon.exe"
2⤵
- Executes dropped EXE
PID:3848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\beacon.exe
Filesize
281KB

MD5
54d28cf4da7551746796be18fe566b9f

SHA1
62ea3dbc751e84eb449cb585b2d9f688447d388f

SHA256
0282c0cae37a02810e543338856d9c67aaedb1d5b990336a77ae9ac78898f831

SHA512
8f553897d431795c80e0fc557ceb4bcfd81a422dfee3cb6d94f0416fce3c5f3a7b28e451ee57af70ddf638526a867b2ed6eb69bebe9e354a69d283fc2a0f1c62

Download Submit
C:\Users\Public\beacon.exe
Filesize
281KB

MD5
54d28cf4da7551746796be18fe566b9f

SHA1
62ea3dbc751e84eb449cb585b2d9f688447d388f

SHA256
0282c0cae37a02810e543338856d9c67aaedb1d5b990336a77ae9ac78898f831

SHA512
8f553897d431795c80e0fc557ceb4bcfd81a422dfee3cb6d94f0416fce3c5f3a7b28e451ee57af70ddf638526a867b2ed6eb69bebe9e354a69d283fc2a0f1c62

Download Submit
C:\Users\Public\beacon.exe
Filesize
281KB

MD5
54d28cf4da7551746796be18fe566b9f

SHA1
62ea3dbc751e84eb449cb585b2d9f688447d388f

SHA256
0282c0cae37a02810e543338856d9c67aaedb1d5b990336a77ae9ac78898f831

SHA512
8f553897d431795c80e0fc557ceb4bcfd81a422dfee3cb6d94f0416fce3c5f3a7b28e451ee57af70ddf638526a867b2ed6eb69bebe9e354a69d283fc2a0f1c62

Download Submit
memory/3848-11-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download
memory/3848-12-0x0000000000650000-0x000000000069C000-memory.dmp

Filesize
304KB

Download
memory/3848-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3848-14-0x0000000000650000-0x000000000069C000-memory.dmp

Filesize
304KB

Download