Malware Analysis Report

2024-08-06 11:04

Sample ID 231219-tad31shagn
Target 107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a
SHA256 107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a
Tags
cobaltstrike 100000000 backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a

Threat Level: Known bad

The file 107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a was found to be: Known bad.

Malicious Activity Summary

cobaltstrike 100000000 backdoor trojan

Cobaltstrike

Enumerates connected drives

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-12-19 15:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-19 15:50

Reported

2023-12-19 15:53

Platform

win7-20231215-en

Max time kernel

149s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1812 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe

"C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe"

Network

Country Destination Domain Proto
US 38.180.74.136:8999 38.180.74.136 tcp
US 38.180.74.136:8999 38.180.74.136 tcp
US 38.180.74.136:8999 38.180.74.136 tcp
US 38.180.74.136:8999 38.180.74.136 tcp
US 38.180.74.136:8999 38.180.74.136 tcp
US 38.180.74.136:8999 tcp

Files

memory/1288-0-0x0000000002600000-0x0000000002601000-memory.dmp

memory/1288-1-0x0000000002600000-0x0000000002601000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab3DEC.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/1288-18-0x0000000009070000-0x00000000094E2000-memory.dmp

memory/1288-19-0x0000000008C70000-0x0000000009070000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar4907.tmp

MD5 e57b5cb54f9a262359b05895ecba9a6a
SHA1 74fb771f7ff071601ec5b44fa3eec60a5375e5f8
SHA256 01224e4d54a0d127cbcac6e3832bc02e89992b7128f1f0828f9a425f1913854b
SHA512 9a7c73bbbc3d33b7b6aa2ef13723ff2111826632d6a6ba67b067420d74febe7e21dd8e9528751c20ec780044d549c72ebe1b3dc4e9b9875be49339d878b51297

memory/1288-38-0x0000000008C70000-0x0000000009070000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-19 15:50

Reported

2023-12-19 15:53

Platform

win10v2004-20231215-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe

"C:\Users\Admin\AppData\Local\Temp\107be38151fe29fe880e1144d12490989807d1d0aa66dd42985083daccbeb98a.exe"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 21.177.190.20.in-addr.arpa udp
US 38.180.74.136:8999 38.180.74.136 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 136.74.180.38.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 38.180.74.136:8999 38.180.74.136 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 38.180.74.136:8999 38.180.74.136 tcp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 38.180.74.136:8999 38.180.74.136 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 38.180.74.136:8999 38.180.74.136 tcp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/3596-0-0x00000000027C0000-0x00000000027C1000-memory.dmp

memory/3596-1-0x000000000D460000-0x000000000D8D2000-memory.dmp

memory/3596-2-0x000000000D060000-0x000000000D460000-memory.dmp

memory/3596-3-0x000000000D060000-0x000000000D460000-memory.dmp