cobaltstrike | 6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb

Analysis

max time kernel
156s
max time network
187s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe
Size

22KB
MD5

613b1a268d2e7c4d1721de88fdabb036
SHA1

e5421231ac4ebb55ae475f52076d28ab6de5111a
SHA256

6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb
SHA512

8f0a27ed86e252aa91408056b3a8966151eb8b40218c5f2b89198bc975da40f7c2e09a7d37609f06749b24d455db6ffd7faaf7a44f3f2c62aca3e25d14aefae6
SSDEEP

384:FjSfrjscTsBJryaa0jn8w1EUtwzVueHwKM5BZMsrgZdUSz3/Yc/PC:te3rFAjnNtEuwk5rgZzL/Yc/PC

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://150.158.194.26:18443/CDcs

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2760	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	tasklist.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2760	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	29
PID 2688 wrote to memory of 2760	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	29
PID 2688 wrote to memory of 2760	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	29
PID 2688 wrote to memory of 2516	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	32
PID 2688 wrote to memory of 2516	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	32
PID 2688 wrote to memory of 2516	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	32
PID 2688 wrote to memory of 2380	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	35
PID 2688 wrote to memory of 2380	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	35
PID 2688 wrote to memory of 2380	2688	6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe	35

C:\Users\Admin\AppData\Local\Temp\6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe
"C:\Users\Admin\AppData\Local\Temp\6dbb2232508cd31f09ca6ab47b4ba5aa21b9081e4d92079d6c8eff48e0672fbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\tasklist.exe
  "tasklist.exe" /svc
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\getmac.exe
  "getmac.exe"
  2⤵
  PID:2516
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c echo %WINDIR%
  2⤵
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-0-0x000000013FC30000-0x000000013FC3A000-memory.dmp

Filesize
40KB

Download
memory/2688-1-0x000007FEF5010000-0x000007FEF59FC000-memory.dmp

Filesize
9.9MB

Download
memory/2688-2-0x000007FEF5010000-0x000007FEF59FC000-memory.dmp

Filesize
9.9MB

Download
memory/2688-3-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download