cobaltstrike | 6bbabed7b0f11e304b0cb97013c9095d51fa330aee3a966b5626088e92a0dfeb

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b67d52bf30515f2537b0a3a076ee60dd.exe
Size 2.0MB
Sample240306-exj58aah41
SHA256 6bbabed7b0f11e304b0cb97013c9095d51fa330aee3a966b5626088e92a0dfeb
MD5 b67d52bf30515f2537b0a3a076ee60dd
SHA1 b1c9f57fc7f1ff921a54e0924a1d7bd9c1edb68b
SHA512 8a4b887fe795231f2dd9fd3150cd098f375c7f0d83536ff06268036208ce8be6ee72a2fda8a1b6db81ad7b79c59b96d53bc89710f1f04d4d90df9adcdd8b994a
SSDEEP 24576:8vD/8Oxqy4G3a1/0RtrlrAmTOflhrXOqOUrD2xxD1vJPX:8jyyZ3a1/0RtrlrAbtVKhxD1hPX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://47.100.48.157:8787/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 1616	3712	b67d52bf30515f2537b0a3a076ee60dd.exe	88
PID 3712 wrote to memory of 1616	3712	b67d52bf30515f2537b0a3a076ee60dd.exe	88
PID 1616 wrote to memory of 4512	1616	cmd.exe	90
PID 1616 wrote to memory of 4512	1616	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\b67d52bf30515f2537b0a3a076ee60dd.exe
"C:\Users\Admin\AppData\Local\Temp\b67d52bf30515f2537b0a3a076ee60dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c "start 7月网格自主发展情况通报0725.txt"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7月网格自主发展情况通报0725.txt
    3⤵
    PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7月网格自主发展情况通报0725.txt

Path C:\Users\Admin\AppData\Local\Temp\7月网格自主发展情况通报0725.txt
Size 442B
SHA256 cd83d993a216b269a62c3678394b8500162c259a35d36b4000ea165028080c43
MD5 2d0cd72ef9e2bbb91af9aa3e2a269fa6
SHA1 8537cef926f6af02f5cebf470fd5629b9314c24f
SHA512 3e5f610e841312524a248508fc1c8b4b0bf205367132831f6983bff178002fa63defa1ec9777633f588be2369a647d9ee81a537016f733224608e40951279d6e
MD5 SHA1 SHA512

Submit Download

memory/3712-3-0x000001A1EBC50000-0x000001A1EBC51000-memory.dmp

Download