cobaltstrike | 84c8bb6a84391404ae1ab0dc9760d87a35253bb4638b20156eb3dc1aeccb8e99

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 09:07

Target

1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe
Size

3.2MB
MD5

1e1735bff2d3c91b471c36ea563014b8
SHA1

5eb30dfa2fdc41d34c0a52da384aa531331c6343
SHA256

84c8bb6a84391404ae1ab0dc9760d87a35253bb4638b20156eb3dc1aeccb8e99
SHA512

964251a36457435095fea7b674d2eb30ea6fcb9ef66fa1ccfa6dc884beac6d577fdd26b0d45e2855d3ab77707db4d9b39410749fd61b395cf71a30c35d5cfaf5
SSDEEP

49152:RQiViH+n1gyPrKWiCSE7Mf6L5WZsF8JrxIsnT:OiI8NKWiCLgXh

Score

10^/10

Family

cobaltstrike

http://apt.freelinuxupdate.tk:2053/bootstrap-2.min.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Executes dropped EXE 1 IoCs

Processes:

go-memexec-476584703.exe

pid process

2992 go-memexec-476584703.exe
Loads dropped DLL 1 IoCs

Processes:

1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe

pid process

2976 1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe

pid	process
2992	go-memexec-476584703.exe

pid	process
2976	1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe

description	pid	process	target process
PID 2976 wrote to memory of 2992	2976	1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe	go-memexec-476584703.exe
PID 2976 wrote to memory of 2992	2976	1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe	go-memexec-476584703.exe
PID 2976 wrote to memory of 2992	2976	1e1735bff2d3c91b471c36ea563014b8_JaffaCakes118.exe	go-memexec-476584703.exe

C:\Users\Admin\AppData\Local\Temp\go-memexec-476584703.exe
C:\Users\Admin\AppData\Local\Temp\go-memexec-476584703.exe
2⤵
- Executes dropped EXE
PID:2992

C:\Users\Admin\AppData\Local\Temp\go-memexec-476584703.exe
Filesize
328KB

MD5
58336a3811207c8d3f57709317b172e9

SHA1
221f507292989dbd52c3a26df4d3fb9f1d80af7a

SHA256
a3afb74b961f0b9b6e484166d61b92eb8ab2a41f0a88cc11f02c6b316ebee74f

SHA512
99b0ccc043f20339d82bcdd5634dfa4ea863fb466121c67c663c12247d1f442cc0868b4cdd06aba64e3684015aa364af9d2ffc8567f14b585efa79d97cd43b80

Download Submit
memory/2992-4-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2992-5-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download