Malware Analysis Report

2024-08-06 07:59

Sample ID 231124-fpvsesff63
Target 32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90
SHA256 32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90
Tags
cobaltstrike 0 1359593325 backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90

Threat Level: Known bad

The file 32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90 was found to be: Known bad.

Malicious Activity Summary

cobaltstrike 0 1359593325 backdoor trojan

Cobaltstrike

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2023-11-24 05:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-24 05:03

Reported

2023-11-24 05:05

Platform

win7-20231023-en

Max time kernel

143s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe
PID 2228 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe
PID 2228 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe
PID 2228 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe

"C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe"

C:\Windows\explorer.exe

C:/Windows/explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.checkavail.space udp
US 188.114.97.0:80 cdn.checkavail.space tcp
US 188.114.97.0:80 cdn.checkavail.space tcp
US 188.114.97.0:80 cdn.checkavail.space tcp
US 188.114.97.0:80 cdn.checkavail.space tcp
US 188.114.97.0:80 cdn.checkavail.space tcp

Files

memory/2228-0-0x0000000000940000-0x0000000000C7E000-memory.dmp

memory/2228-1-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

memory/2228-2-0x000000001B650000-0x000000001B6D0000-memory.dmp

memory/2664-3-0x00000000000E0000-0x0000000000120000-memory.dmp

memory/2664-5-0x00000000000E0000-0x0000000000120000-memory.dmp

memory/2228-7-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

memory/2664-6-0x000007FEF6DC0000-0x000007FEF6E6C000-memory.dmp

memory/2664-8-0x000007FEF6DC0000-0x000007FEF6E6C000-memory.dmp

memory/2664-16-0x000007FEF6DC0000-0x000007FEF6E6C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-24 05:03

Reported

2023-11-24 05:06

Platform

win10v2004-20231020-en

Max time kernel

143s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 428 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe
PID 428 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe
PID 428 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe

"C:\Users\Admin\AppData\Local\Temp\32d48e683861c1a37bce4410adc58d36b86bfda8121ff1deb73ef82008731d90.exe"

C:\Windows\explorer.exe

C:/Windows/explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 126.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 cdn.checkavail.space udp
US 188.114.96.0:80 cdn.checkavail.space tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 188.114.96.0:80 cdn.checkavail.space tcp
US 188.114.96.0:80 cdn.checkavail.space tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 188.114.96.0:80 cdn.checkavail.space tcp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
US 188.114.96.0:80 cdn.checkavail.space tcp

Files

memory/428-0-0x00000000007F0000-0x0000000000B2E000-memory.dmp

memory/428-1-0x00007FFA38450000-0x00007FFA38F11000-memory.dmp

memory/428-2-0x000000001B7B0000-0x000000001B7C0000-memory.dmp

memory/3280-4-0x00000000005B0000-0x00000000005F0000-memory.dmp

memory/3280-5-0x00007FFA36850000-0x00007FFA368DD000-memory.dmp

memory/428-6-0x00007FFA38450000-0x00007FFA38F11000-memory.dmp

memory/3280-7-0x00007FFA36850000-0x00007FFA368DD000-memory.dmp

memory/3280-10-0x00007FFA36850000-0x00007FFA368DD000-memory.dmp

memory/3280-13-0x00007FFA36850000-0x00007FFA368DD000-memory.dmp

memory/3280-17-0x00007FFA36850000-0x00007FFA368DD000-memory.dmp

memory/3280-20-0x00007FFA36850000-0x00007FFA368DD000-memory.dmp