Malware Analysis Report

2024-08-06 07:57

Sample ID 230904-tnvmxshf46
Target 2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.exe
SHA256 03c5895694085319aedd6f00df4b0fdcb88472ba1387f7befd76a2cd69d5a433
Tags
1359593325 cobaltstrike
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

03c5895694085319aedd6f00df4b0fdcb88472ba1387f7befd76a2cd69d5a433

Threat Level: Known bad

The file 2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.exe was found to be: Known bad.

Malicious Activity Summary

1359593325 cobaltstrike

Cobalt Strike reflective loader

Cobaltstrike family

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2023-09-04 16:12

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A

Cobaltstrike family

cobaltstrike

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-04 16:12

Reported

2023-09-04 16:15

Platform

win7-20230831-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1384 wrote to memory of 2412 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2412 wrote to memory of 2140 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2412 wrote to memory of 2140 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2412 wrote to memory of 2140 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2412 wrote to memory of 2140 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 232

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-04 16:12

Reported

2023-09-04 16:15

Platform

win10v2004-20230831-en

Max time kernel

140s

Max time network

146s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1772 wrote to memory of 4308 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1772 wrote to memory of 4308 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1772 wrote to memory of 4308 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_5717b5b8f98491e6d746fd74c978a65f_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 4308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 632

Network

Country Destination Domain Proto
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 126.177.238.8.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 77.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

N/A