cobaltstrike | 62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64

General

Target

62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
Size

5.3MB
MD5

a738343a752f47cdb5aa6f3d7a70f0ce
SHA1

1b9a7b0d75dddb27c930630848e016f1f405aca8
SHA256

62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64
SHA512

f53585351204e39507a79bac23cd364d614743b5f16483998ed7c4f8dfaa2f628fdfc99e51f6666a39f5e38f9203a77ad6bc5231b03ea89a3ab36745f4385dc4
SSDEEP

98304:8eaLq2gXJAT86nXlXxHhNZEYoPHGlBBYYYR9MU6JADxuJfUm5iaI4I:8ebNJAT8UXlVhNiYofG7rYnEuDctUN

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://123.60.162.164:80/qs5D

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
7	4032	powershell.exe
34	4032	powershell.exe
35	4032	powershell.exe
39	4032	powershell.exe
44	4032	powershell.exe
46	4032	powershell.exe
51	4032	powershell.exe

Loads dropped DLL 2 IoCs

Processes:

62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe

pid	process
2832	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
2832	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4032 powershell.exe
4032 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exepowershell.exe

description pid process

Token: 35 2832 62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
Token: SeDebugPrivilege 4032 powershell.exe

pid	process
4032	powershell.exe
4032	powershell.exe

description	pid	process
Token: 35	2832	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
Token: SeDebugPrivilege	4032	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.execmd.exe

description	pid	process	target process
PID 920 wrote to memory of 2832	920	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
PID 920 wrote to memory of 2832	920	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
PID 2832 wrote to memory of 4012	2832	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe	cmd.exe
PID 2832 wrote to memory of 4012	2832	62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe	cmd.exe
PID 4012 wrote to memory of 4032	4012	cmd.exe	powershell.exe
PID 4012 wrote to memory of 4032	4012	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
"C:\Users\Admin\AppData\Local\Temp\62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:920

C:\Users\Admin\AppData\Local\Temp\62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe
"C:\Users\Admin\AppData\Local\Temp\62c41a9ab5747f5a9d7d3947c3704f1b3e27a47693a088843e54ddd54c12ac64.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -ExecutionPolicy Unrestricted -File C:\ProgramData/script2.ps1"
3⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Unrestricted -File C:\ProgramData/script2.ps1
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\script.ps1

Filesize
4KB

MD5
c1a8203641b941b2f1feed7003b980e3

SHA1
3a8fdbfec2417f7f7cef7766054072569a922407

SHA256
fcfd998f3c9cf57e18bf434ddf8ff6d6dcdac79e00f08b840479c838613cfbbd

SHA512
4d8510b1a1359b71bb0617a9040f6c393be815bf85dd76190bc04b1b5c40e38bb5e08ddff7e538725b55b31dfbfabd7d3b8fe7be492b875c65b5eb35ebc92754

Download Submit
C:\ProgramData\script2.ps1

Filesize
721B

MD5
b23d0f8780680910c158262a7545be4b

SHA1
34bdd31fe0a63b930bc44a88f4a5f283175c8ea6

SHA256
3a20a3cac48a53888253aff623d12ac9dce01a8792a8d5f95255dc881a6db90f

SHA512
9ec058ef22dff6e01a1dc930c5b29c64ca972fdc184345c245d8a10a61e68e5e5232f6724fedd96d507e4336fa12ab4757b245973576c093cdff5850cab9fcff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9202\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9202\base_library.zip

Filesize
759KB

MD5
79e88f2168b50571ecdf412c2d9a444a

SHA1
fda77e1b67812ebd48d5a77c31a58758a27dd80f

SHA256
65d1384c1fd5cc09d7d6ee7da7dbb65258dc4101c7aac20bced7ec50394f43fe

SHA512
55f0d9bef706c2c4ee4260f6444aebc2c9af46304b7bd4ed6d8c90589d9e6925c0f5b9a875997564bd21d905a0945e16879ed8af0f0d6abb799b4d932167cd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9202\python37.dll

Filesize
3.6MB

MD5
5d8c22938d89077f64537a9d09cf6fd5

SHA1
15971f1b4bc2420eafbd40b0cd3fc4d2af204ec4

SHA256
8eb835d88e72e998b82916fb20a252af615d6e641827e013411239d115d5dd69

SHA512
dbd1febd18e29eab046b98f6b970e35e040adddead81561c0d165a1353a124d1dc26f3b3f5aa9ef0cb8e813baa8fc706514c0350c6428f25c5e5c050773b7d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zrmuxhir.txk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4032-32-0x000002187F560000-0x000002187F582000-memory.dmp

Filesize
136KB

Download
memory/4032-43-0x0000021801460000-0x0000021801470000-memory.dmp

Filesize
64KB

Download
memory/4032-44-0x0000021801460000-0x0000021801470000-memory.dmp

Filesize
64KB

Download
memory/4032-42-0x00007FF8B9280000-0x00007FF8B9D41000-memory.dmp

Filesize
10.8MB

Download
memory/4032-47-0x000002181BD90000-0x000002181BD91000-memory.dmp

Filesize
4KB

Download
memory/4032-48-0x00007FF8B9280000-0x00007FF8B9D41000-memory.dmp

Filesize
10.8MB

Download
memory/4032-49-0x0000021801460000-0x0000021801470000-memory.dmp

Filesize
64KB

Download
memory/4032-50-0x0000021801460000-0x0000021801470000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads