cobaltstrike | 8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1

Analysis

max time kernel
149s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1.exe
Size 9.0MB
Sample240224-c2lhqsfe5v
SHA256 8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1
MD5 dd345b396bce0f93096012aa13b9379e
SHA1 3759c6ed77c708c4ed4b0c962dc67c13dbae797f
SHA512 354cd2d1fd52b4405ff5ef1a5885518652fb1d9837a0792cece8d727a8cf0f3bcd7657d40d29121cf1a92e8dbfa758119b7ce4637af2fecdc7ea7623dba585c5
SSDEEP 49152:BL5mUpeTdGWzbsaW809OPVZ559Exy2miymdKplo8Rtu0VaZAmQH083LWSNIEaZMw:re/h913mqyu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://59.110.142.91:1145/PRFu

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 1 IoCs

pid	Process
4660	6mf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3452	8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3948	3452	8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1.exe	87
PID 3452 wrote to memory of 3948	3452	8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1.exe	87
PID 3948 wrote to memory of 4660	3948	cmd.exe	89
PID 3948 wrote to memory of 4660	3948	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1.exe
"C:\Users\Admin\AppData\Local\Temp\8f4b863934903ba4affff04b4b6578b32c510436cd7aa8a25dc1030a0744aba1.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\system32\cmd.exe
  cmd " /c " C:\Users\Admin\AppData\Local\Temp\6mf.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Users\Admin\AppData\Local\Temp\6mf.exe
    C:\Users\Admin\AppData\Local\Temp\6mf.exe
    3⤵
    - Executes dropped EXE
    PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

6mf.exe

Path C:\Users\Admin\AppData\Local\Temp\6mf.exe
Size 1.5MB
SHA256 c00e4501d4ebf8e92fb2ea6a166adf1e516943970693c6b29fd81984e2aa9ec7
MD5 f132ba474925604f05cbc1df1f0a79e3
SHA1 53b1343a976053486190beff3d68b9a7efb09d1a
SHA512 b18b2aae2a5a71b71420e328573dbd1192b04aac4ff19f1b1fa99b3bda813578ba7719f0b2653c6bab2632d4db871c4aa80e099ff28ee9418948137753dafd54
SSDEEP 24576:HueZWsxuDi2mtaBh07Rp4+V+Vr39qRKlBkWSP7HZ7VX:OQW6uDZu7RO+o9qGOl7ZpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

6mf.exe

Path C:\Users\Admin\AppData\Local\Temp\6mf.exe
Size 1.6MB
SHA256 3d4c2c7e223b09aee66b4a176bbac6a77f8619676901341806195a4bf12873bb
MD5 50b51e80f468f300c66db92607010660
SHA1 f84e11d0b73ea8b6977d49fc06f384d3c1cbf89a
SHA512 ec8dd484b6de350ba8a78c7d7e82321883577ed84396badce37cae68318029894c1dc8895679162503681b55d38d4247e02d961d26697cc1a39f8e9a919c48ad
SSDEEP 24576:HueZWsxuDi2mtaBh07Rp4+V+Vr39qRKlBkWSP7HZ7V3q:OQW6uDZu7RO+o9qGOl7Zp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4660-6-0x0000021E49350000-0x0000021E494C3000-memory.dmp

Download

memory/4660-7-0x0000021E4AF50000-0x0000021E4B152000-memory.dmp

Download

memory/4660-8-0x0000021E4AF50000-0x0000021E4B152000-memory.dmp

Download

memory/4660-9-0x0000021E4AF50000-0x0000021E4B152000-memory.dmp

Download

memory/4660-10-0x0000021E4AF50000-0x0000021E4B152000-memory.dmp

Download

memory/4660-11-0x0000021E4AEB0000-0x0000021E4AEB1000-memory.dmp

Download

memory/4660-12-0x0000021E4AF50000-0x0000021E4B152000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads