cobaltstrike | 91117f4b4ce804e6e38c5e1312ba8f0176beb3dc91ba21243508abb09f103c79

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20-10-2023 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91117f4b4ce804e6e38c5e1312ba8f0176beb3dc91ba21243508abb09f103c79.exe
Size

159KB
MD5

2d8efc49a797e5c63d07bc124be2e2dc
SHA1

b3f71801187751b09ef928376a0c6985264373f5
SHA256

91117f4b4ce804e6e38c5e1312ba8f0176beb3dc91ba21243508abb09f103c79
SHA512

daf195d8fa273a2bf5ec7495cd7501a2536caa6fb3a6915c1fef7af0411b455ca7ad1a87204a54349c6151c0e3b3966b8ffdd9d1b20ae3016bdc18e8dcddea69
SSDEEP

3072:zqPrDoPMFQjq5zhSJ8REJ84j+pQXslS8cDN0YleImqyTJJHJBS:zszSJkErclMD+YlT3oH

Score

10^/10

cobaltstrike 100000 backdoor trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

http://192.168.1.11:80/owa/

Attributes

access_type
512
host
192.168.1.11,/owa/
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAACGQ29va2llOiBNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZD05NWMxOGQ4LTRkY2U5ODU0O0NsaWVudElkPTFDMEY2QzVEOTEwRjk7TVNQQXV0aD0zRWtBakRLakk7eGlkPTczMGJmNzt3bGE0Mj1aRzB5TXpBMktqRXMAAAAHAAAAAAAAAA0AAAAFAAAAAndhAAAACQAAAA5wYXRoPS9jYWxlbmRhcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAABAAAADQAAAAUAAAACd2EAAAAHAAAAAAAAAA0AAAACAAAABndsYTQyPQAAAAIAAAALeGlkPTczMGJmNzsAAAACAAAAEk1TUEF1dGg9M0VrQWpES2pJOwAAAAIAAAAXQ2xpZW50SWQ9MUMwRjZDNUQ5MTBGOTsAAAACAAAAOE1pY3Jvc29mdEFwcGxpY2F0aW9uc1RlbGVtZXRyeURldmljZUlkPTk1YzE4ZDgtNGRjZTk4NTQ7AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
GET
polling_time
10000
port_number
80
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTGlQVYEKx+zEx/XlvnRZHkR4XgeWa6eMBAUG9gpgqOd0Gz2Szgc0nTBqfh75B1qHdxHyaFiW6FM/VOzDCKUEb2XKVeExuPT3bEfDMjZgkGv9ixXhUb5Hp4TmSgoRNVh4AOqLC/tiYMnSmwhGcEh0507I0n+pH/IWD8ZceZbcDQwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.448416512e+09
unknown2
AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown3
1.610612736e+09
uri
/OWA/
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
watermark
100000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2416-0-0x000000013FD70000-0x000000013FDC1000-memory.dmp	upx
behavioral1/memory/2416-3-0x000000013FD70000-0x000000013FDC1000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\91117f4b4ce804e6e38c5e1312ba8f0176beb3dc91ba21243508abb09f103c79.exe
"C:\Users\Admin\AppData\Local\Temp\91117f4b4ce804e6e38c5e1312ba8f0176beb3dc91ba21243508abb09f103c79.exe"
1⤵
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x000000013FD70000-0x000000013FDC1000-memory.dmp

Filesize
324KB

Download
memory/2416-1-0x00000000000C0000-0x0000000000101000-memory.dmp

Filesize
260KB

Download
memory/2416-2-0x0000000000110000-0x000000000018B000-memory.dmp

Filesize
492KB

Download
memory/2416-3-0x000000013FD70000-0x000000013FDC1000-memory.dmp

Filesize
324KB

Download
memory/2416-5-0x0000000000110000-0x000000000018B000-memory.dmp

Filesize
492KB

Download