cobaltstrike | 02f8a34310c1e29f05e95be43338bb7bc0cdceae47462a10a3801ed2eab93d27

General

Target
1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe
Size 19.3MB
Sample240329-kwnd5sec97
SHA256 02f8a34310c1e29f05e95be43338bb7bc0cdceae47462a10a3801ed2eab93d27
MD5 1de06b5e12c970e8541adf5fe65b0097
SHA1 44457eac460c24e0ca2c0252ee2d2eefc8727af9
SHA512 9eb3d5e1fb77edd70360d1f51cfcf793206bfbe458391ad577f52e85266fec15acaae82d818c1d26f1845ec99ceba22495576fe6d480a5fbd4281c9bccc30171
SSDEEP 49152:rtqD5h7V9LYGvZ2wSKhZpPam66qK7YrI3rc1jduXEsu:rtSh7V9sVMpPam66tEMI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://apt.freelinuxupdate.tk:2053/bootstrap-2.min.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 3 IoCs

pid	Process
2156	go-memexec-573495907.exe
2088	go-memexec-934134811.exe
2640	go-memexec-882501415.exe

Loads dropped DLL 5 IoCs

pid	Process
1812	1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe
1812	1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe
2156	go-memexec-573495907.exe
2156	go-memexec-573495907.exe
2088	go-memexec-934134811.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2156	1812	1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe	29
PID 1812 wrote to memory of 2156	1812	1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe	29
PID 1812 wrote to memory of 2156	1812	1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe	29
PID 1812 wrote to memory of 2156	1812	1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2088	2156	go-memexec-573495907.exe	30
PID 2156 wrote to memory of 2088	2156	go-memexec-573495907.exe	30
PID 2156 wrote to memory of 2088	2156	go-memexec-573495907.exe	30
PID 2156 wrote to memory of 2088	2156	go-memexec-573495907.exe	30
PID 2088 wrote to memory of 2640	2088	go-memexec-934134811.exe	31
PID 2088 wrote to memory of 2640	2088	go-memexec-934134811.exe	31
PID 2088 wrote to memory of 2640	2088	go-memexec-934134811.exe	31

C:\Users\Admin\AppData\Local\Temp\1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1de06b5e12c970e8541adf5fe65b0097_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\go-memexec-573495907.exe
  C:\Users\Admin\AppData\Local\Temp\go-memexec-573495907.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\go-memexec-934134811.exe
    C:\Users\Admin\AppData\Local\Temp\go-memexec-934134811.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-882501415.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-882501415.exe
      4⤵
      Executes dropped EXE
      PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

go-memexec-882501415.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-882501415.exe
Size 328KB
SHA256 a3afb74b961f0b9b6e484166d61b92eb8ab2a41f0a88cc11f02c6b316ebee74f
MD5 58336a3811207c8d3f57709317b172e9
SHA1 221f507292989dbd52c3a26df4d3fb9f1d80af7a
SHA512 99b0ccc043f20339d82bcdd5634dfa4ea863fb466121c67c663c12247d1f442cc0868b4cdd06aba64e3684015aa364af9d2ffc8567f14b585efa79d97cd43b80
SSDEEP 6144:t4/za7ALmvWwG8iAPMS7BhJC0NNaHud0WiwmbiaPFpQva8yTVDzZ:C/+e9r6T7XQ0qONs2qFWvXyZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

go-memexec-934134811.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-934134811.exe
Size 3.2MB
SHA256 84c8bb6a84391404ae1ab0dc9760d87a35253bb4638b20156eb3dc1aeccb8e99
MD5 1e1735bff2d3c91b471c36ea563014b8
SHA1 5eb30dfa2fdc41d34c0a52da384aa531331c6343
SHA512 964251a36457435095fea7b674d2eb30ea6fcb9ef66fa1ccfa6dc884beac6d577fdd26b0d45e2855d3ab77707db4d9b39410749fd61b395cf71a30c35d5cfaf5
SSDEEP 49152:RQiViH+n1gyPrKWiCSE7Mf6L5WZsF8JrxIsnT:OiI8NKWiCLgXh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 64KB
SHA256 48bf725a51a556bc5c6230bb250a1b0f42a89d05fff25fdcbfe71b8d67b73009
MD5 bd81296ceb422ef2192cb64ca27a6d71
SHA1 dcbf5a2844fd30a58fc15d9fa603fcfdc5ce62c6
SHA512 6a082b93b9bef406e253fcf9d8c22487c07a1d48997f5ea8a669eaf395b0fc199a6eac41494392f7eddb38b4949d1fd29efbff2c12d55a8725da2c700b2c7b90
SSDEEP 768:+JND6tltnWje8DGxhyFjW0dJCqYajLUxIx5F1cgjDFLk4X0QSoiwgE0vka+r1fTU:B788yFjWzqDUiguqYinE0i1v1Ir8mrEM
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 192KB
SHA256 529a34245f59d45510956abd86e109349e6db82044779c190daa32e6398e8f6a
MD5 e8c5de2f52c3888178195c0fad582651
SHA1 d41d382cd9135c0725a050faab5fd4b021142d31
SHA512 a20ea34937f9534b548d5a2e98ecf16a9e615b8ae6dd02aef2eec5271210fbe80ec295475ffb20ea45e43516d0e9dc4f7bbeba76d49e375b1ce911d49853c34e
SSDEEP 3072:B7+jWzqqpnE0i1vyr80E+E5s2tqPPreF8KHiDo1s5YSi:R+jWGD080y5sjHqiDYs5YH
MD5 SHA1 SHA512 SSDEEP

Submit Download

go-memexec-573495907.exe

Path \Users\Admin\AppData\Local\Temp\go-memexec-573495907.exe
Size 8.5MB
SHA256 7689d79518ea5d74a374c882fcd3c85624c026c858319a3403cf513cc0013705
MD5 786ec6298fecaf3917d8cdd971e4ca6c
SHA1 6a97ab8f62dd82e3f7a90d569dd938e83f7a9039
SHA512 ba3c772bc3cc062a878b5dfa141fae18cb574420ce4a9a9f9d0d4188ae3ede4aa2caa3229073acbbcdc5b9aab4b4790c873f4a1c01477cd86c04b382a35dc322
SSDEEP 49152:bqXEV5Jf21tKNzJIgxDV/iGKzxFbYrIQc10H9u:bqXOJf2f2tV/iGKzkno
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2640-19-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/2640-20-0x0000000000400000-0x0000000000455000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads