cobaltstrike | ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
Size

6.5MB
MD5

12a710ab0307d854f2fd7588b4cd8c1d
SHA1

748ae41980324f2b85fdd7756a08046df972b5c7
SHA256

ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013
SHA512

c9e431b8a0aaf4d41b297b31df4e8c1e9c6ec1804f390f30444a907efa42666ac8a4ad3f4cf91b7d4d133835fb2c43c6920ba4cbf591a6800e795b59bfca5449
SSDEEP

98304:8QvCIfolGMD/x/0feyGgatbQ940BDlgwdnpka9R/k9t+2bJsLGt+NLkxxTGzwA3J:83PlnDfyGgqwBdnpkYRMpWNGx83aE

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://192.168.27.130:80/GfNb

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Loads dropped DLL 6 IoCs

pid	Process
4628	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
4628	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
4628	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
4628	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
4628	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
4628	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4628	5092	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe	86
PID 5092 wrote to memory of 4628	5092	ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe	86

C:\Users\Admin\AppData\Local\Temp\ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
"C:\Users\Admin\AppData\Local\Temp\ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe
  "C:\Users\Admin\AppData\Local\Temp\ef593e1f8ac60ababc6226fa20af1fd5ed7bcd597b9f97aed35d1eb681845013.exe"
  2⤵
  - Loads dropped DLL
  PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI50922\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ctypes.pyd

Filesize
120KB

MD5
1635a0c5a72df5ae64072cbb0065aebe

SHA1
c975865208b3369e71e3464bbcc87b65718b2b1f

SHA256
1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

SHA512
6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ctypes.pyd

Filesize
120KB

MD5
1635a0c5a72df5ae64072cbb0065aebe

SHA1
c975865208b3369e71e3464bbcc87b65718b2b1f

SHA256
1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

SHA512
6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\base_library.zip

Filesize
1.0MB

MD5
a2e9b584f51018a7b760fd16dbfdb6bb

SHA1
ca64159bbe9161306a8bb3c914224dbb94d310c4

SHA256
3bf019609f86ae20ab2f13b18b203169a50765152758e09098aba8b66b16801b

SHA512
b3a966bc244f6903a9b3de4431ba63ed53a714dc19e29d66751571c77776b9964e2c541ba5ab6f23d88a686e81c32b0fe9a2e3e4f52112cbfaf1d3bc48d24e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\tinyaes.cp310-win_amd64.pyd

Filesize
31KB

MD5
5f7048fcba6e2bd21c71ce07b52e0891

SHA1
da0ba80e7e12ec5852567664150cd04c177adc62

SHA256
522abac5cbddc8a97814896ad78909bd4d7458310376b1c44754b29bb449f148

SHA512
a6b09304f0c5852eebd7ce127a4877a93f3ef0cf589726ee92ebf90f8da266ececf50ea4561116de371fa6bff942be9c5b2b44466c98a9597b50cb45c56b9f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\tinyaes.cp310-win_amd64.pyd

Filesize
31KB

MD5
5f7048fcba6e2bd21c71ce07b52e0891

SHA1
da0ba80e7e12ec5852567664150cd04c177adc62

SHA256
522abac5cbddc8a97814896ad78909bd4d7458310376b1c44754b29bb449f148

SHA512
a6b09304f0c5852eebd7ce127a4877a93f3ef0cf589726ee92ebf90f8da266ececf50ea4561116de371fa6bff942be9c5b2b44466c98a9597b50cb45c56b9f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\ucrtbase.dll

Filesize
1011KB

MD5
849959a003fa63c5a42ae87929fcd18b

SHA1
d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

SHA256
6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

SHA512
64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\ucrtbase.dll

Filesize
1011KB

MD5
849959a003fa63c5a42ae87929fcd18b

SHA1
d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

SHA256
6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

SHA512
64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

Download Submit
memory/4628-68-0x0000024D35AD0000-0x0000024D35AD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads