cobaltstrike | 24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe
Size

477KB
MD5

d56f6219a261d4738c459aea2c5a86e9
SHA1

7c0bbd32d14fcc7dc99a9fd004c761d1a12290f5
SHA256

24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226
SHA512

cda623f402d468cbbf1ecc30df563d4f3c56697cb71f5093de6a37d392adecc32f2771c538c097ea108c1bbbc5f6caf191387e9ef9664a5cc2005f4611f71efd
SSDEEP

12288:mCYtNDwqkXJAe4Q5oWqZPVyGDEQPJlhPVMq9QbPF7Nw:v8Dpte4Q9gtyGIkvhtMbU

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Extracted

Family

cobaltstrike

http://:0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/2680-0-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp	UPX
behavioral2/memory/2680-16453-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2680-0-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp	upx
behavioral2/memory/2680-16453-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp	upx

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84
PID 2680 wrote to memory of 208	2680	24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe	84

C:\Users\Admin\AppData\Local\Temp\24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe
"C:\Users\Admin\AppData\Local\Temp\24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System32\wusa.exe
  C:\Windows\System32\wusa.exe
  2⤵
  PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-1-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-2-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-4-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-3-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-6-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-7-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-5-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-8-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-10-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-9-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-12-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-13-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-11-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-14-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-15-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-16-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-17-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-18-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-19-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-20-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-21-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-22-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-23-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-25-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-26-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-27-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-28-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-29-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-30-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-31-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-32-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-33-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-34-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-36-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-35-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-37-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-38-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-39-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-40-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-41-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-42-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-43-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-51-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-50-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-53-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-52-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-49-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-54-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-55-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-56-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-48-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-58-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-59-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-57-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-47-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-46-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-45-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-44-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-60-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-61-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-62-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-63-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-64-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

Filesize
260KB

Download
memory/208-16457-0x000001C2C3AB0000-0x000001C2C3F22000-memory.dmp

Filesize
4.4MB

Download
memory/208-16460-0x000001C2C3AB0000-0x000001C2C3F22000-memory.dmp

Filesize
4.4MB

Download
memory/2680-0-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp

Filesize
784KB

Download
memory/2680-16453-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp

Filesize
784KB

Download