cobaltstrike | 8792ad217a3e74c8b3f09da095c98b0f75074e3d0a52711ccd46ff40b6e44d51

General

Target

2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe
Size

91KB
MD5

20b5cf2c27b496d579eff920b6b020ea
SHA1

eb5cd4c784c3f8e84712e4f8d9cf0fcbf9ddcffd
SHA256

8792ad217a3e74c8b3f09da095c98b0f75074e3d0a52711ccd46ff40b6e44d51
SHA512

d8c0084fa00713baed9dbd8c4d9f8fccb3052eedddf21d632f69d59b204330fef9a15e42200296af822bae54a30d367d8dd4967f3eb6e2a6e7307d2c3369920e
SSDEEP

1536:suRFSPMJQAS2K7+gZfkEgaIwgKG1sWVdc9dlDXnGa9VhR68MIF:suzSPwq7BFkErHRGHUl3t9VhRZ

Score

10^/10

cobaltstrike 100000000 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://154.204.58.234:4433/jquery-3.3.2.slim.min.js

http://|}l��k�(O��]��7�v��\��h��%vYk:|tS��u�T�}�"��S��9=,��0 ZL�U�`#��O��+�,��O��zj��n+B��=>J��(/i��Y��L\j��/5�;�= �`DΥ�N�� ԗ��v`�T��iEpt:91204|}l��k�(O��]��7�v��\��h��%vYk:|tS��u�T�}�"��S��9=,��0 ZL�U�`#��O��+�,��O��zj��n+B��=>J��(/i��Y��L\j��/5�;�= �`DΥ�N�� ԗ��v`�T��iEpt

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4242.0 Safari/537.36

Extracted

Family

cobaltstrike

Botnet

100000000

C2

http://154.204.58.234:4433/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
host
154.204.58.234,/jquery-3.3.1.min.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
12800
polling_time
11884
port_number
4433
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClVljC9Jbzx0htq17nyIhVYwOzZkECUcRo50z5WeiFQeqgEffiX66wEgtfaC3WUhbr7/ZAFIK0c8FwDYRJ5eNJPUnfIbojk+tgJJQTA2ndcVp6pGryeVc8xXjRcGTeNHcDYm1c8k/lNwPAMZosg+xt9RuFMKNz6QpjzPJggwJO0QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4242.0 Safari/537.36
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe

pid process

4992 2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe
4992 2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe
Suspicious use of WriteProcessMemory 1 IoCs

Processes:

2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe

description pid process target process

PID 4992 wrote to memory of 3532 4992 2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe Explorer.EXE

pid	process
4992	2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe
4992	2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe

description	pid	process	target process
PID 4992 wrote to memory of 3532	4992	2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-26_20b5cf2c27b496d579eff920b6b020ea_ryuk.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-0-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/3532-1-0x000000000CE20000-0x000000000D292000-memory.dmp

Filesize
4.4MB

Download
memory/3532-2-0x000000000C620000-0x000000000CA20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-3-0x000000000D2A0000-0x000000000D712000-memory.dmp

Filesize
4.4MB

Download
memory/3532-4-0x000000000CA20000-0x000000000CE20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-5-0x000000000D720000-0x000000000DB92000-memory.dmp

Filesize
4.4MB

Download
memory/3532-6-0x000000000C620000-0x000000000CA20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-7-0x000000000DBA0000-0x000000000E012000-memory.dmp

Filesize
4.4MB

Download
memory/3532-8-0x000000000CA20000-0x000000000CE20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-9-0x000000000E020000-0x000000000E492000-memory.dmp

Filesize
4.4MB

Download
memory/3532-10-0x000000000C620000-0x000000000C786000-memory.dmp

Filesize
1.4MB

Download
memory/3532-11-0x000000000ECA0000-0x000000000F112000-memory.dmp

Filesize
4.4MB

Download
memory/3532-12-0x000000000E4A0000-0x000000000E8A0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-13-0x000000000F120000-0x000000000F592000-memory.dmp

Filesize
4.4MB

Download
memory/3532-14-0x000000000E8A0000-0x000000000ECA0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-15-0x000000000C620000-0x000000000CA20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-16-0x000000000F5A0000-0x000000000FA12000-memory.dmp

Filesize
4.4MB

Download
memory/3532-17-0x000000000E4A0000-0x000000000E5FC000-memory.dmp

Filesize
1.4MB

Download
memory/3532-18-0x000000000C620000-0x000000000CA20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-19-0x000000000CA20000-0x000000000CE20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-20-0x000000000FE20000-0x0000000010292000-memory.dmp

Filesize
4.4MB

Download
memory/3532-21-0x000000000C620000-0x000000000C786000-memory.dmp

Filesize
1.4MB

Download
memory/3532-22-0x000000000E710000-0x000000000E873000-memory.dmp

Filesize
1.4MB

Download
memory/3532-23-0x00000000106A0000-0x0000000010B12000-memory.dmp

Filesize
4.4MB

Download
memory/3532-24-0x000000000E4A0000-0x000000000E8A0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-25-0x000000000FA20000-0x000000000FE20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-26-0x000000000E8A0000-0x000000000ECA0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-27-0x0000000010B20000-0x0000000010F92000-memory.dmp

Filesize
4.4MB

Download
memory/3532-28-0x00000000102A0000-0x00000000106A0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-29-0x000000000E4A0000-0x000000000E5FC000-memory.dmp

Filesize
1.4MB

Download
memory/3532-30-0x00000000113A0000-0x0000000011812000-memory.dmp

Filesize
4.4MB

Download
memory/3532-31-0x00000000102A0000-0x00000000106A0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-32-0x0000000011820000-0x0000000011C92000-memory.dmp

Filesize
4.4MB

Download
memory/3532-33-0x000000000E710000-0x000000000E873000-memory.dmp

Filesize
1.4MB

Download
memory/3532-34-0x0000000010FA0000-0x00000000110F8000-memory.dmp

Filesize
1.3MB

Download
memory/3532-35-0x0000000011CA0000-0x0000000012112000-memory.dmp

Filesize
4.4MB

Download
memory/3532-36-0x000000000FA20000-0x000000000FE20000-memory.dmp

Filesize
4.0MB

Download
memory/3532-37-0x00000000102A0000-0x00000000103FD000-memory.dmp

Filesize
1.4MB

Download
memory/3532-38-0x00000000102A0000-0x00000000106A0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-39-0x0000000012920000-0x0000000012D92000-memory.dmp

Filesize
4.4MB

Download
memory/3532-40-0x0000000012DA0000-0x0000000013212000-memory.dmp

Filesize
4.4MB

Download
memory/3532-41-0x0000000013220000-0x0000000013692000-memory.dmp

Filesize
4.4MB

Download
memory/3532-42-0x0000000010FA0000-0x00000000110F8000-memory.dmp

Filesize
1.3MB

Download
memory/3532-43-0x00000000124A0000-0x00000000125FF000-memory.dmp

Filesize
1.4MB

Download
memory/3532-44-0x00000000102A0000-0x00000000103FD000-memory.dmp

Filesize
1.4MB

Download
memory/3532-45-0x0000000013AA0000-0x0000000013F12000-memory.dmp

Filesize
4.4MB

Download
memory/3532-46-0x00000000136A0000-0x0000000013AA0000-memory.dmp

Filesize
4.0MB

Download
memory/3532-47-0x0000000012120000-0x0000000012520000-memory.dmp

Filesize
4.0MB

Download
memory/3532-48-0x00000000124A0000-0x00000000125FF000-memory.dmp

Filesize
1.4MB

Download
memory/3532-49-0x00000000136A0000-0x0000000013AA0000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads