cobaltstrike | c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6.dll
Size

285KB
MD5

3bb71cef8a643cf00aef4ed04a599b12
SHA1

bf8a77be54fffaca0775b2947e29b46959c010b9
SHA256

c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
SHA512

82f48dd1f2bab3cb53f9d0127f4dc53a247e5af05a1ae7b7f6271bf1676560305df726c72bd330a387edba86714bfe45b65029720b4faeaf1a10a905fe617a9e
SSDEEP

6144:Rpb77NuFerqK7RcRYkcrY4MCIt07iPlvU0jVI8:fNuFe+MnES76U0jVI8

Score

10^/10

cobaltstrike 305419896 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

http://104.31.76.215:80/jquery-3.3.2.min.js

http://172.67.168.227:80/jquery-3.3.2.min.js

http://104.31.77.215:80/jquery-3.3.2.min.js

Attributes

access_type
512
dns_idle
1.34744072e+08
host
104.31.76.215,/jquery-3.3.2.min.js,172.67.168.227,/jquery-3.3.2.min.js,104.31.77.215,/jquery-3.3.2.min.js
http_header1
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABZBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAALc2Vzc2lvbl9pZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAAEAAAABhIb3N0OiBzdGF0aWMubWluaXdpc2UubWUAAAAKAAAAC0FjY2VwdDogKi8qAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IGVuAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAABAAAADQAAAAQAAAAHAAAAAAAAAA0AAAAFAAAAAmlkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
8448
maxdns
245
polling_time
37500
port_number
80
sc_process32
%windir%\syswow64\ktmutil.exe
sc_process64
%windir%\sysnative\ktmutil.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCF0Hv1f5APRNApuC/MnRL8V04hCN5gcntJtYm48yXAuZipkyUXHpsUNi1S00duHZ26x62ObQ6fKvEZdG2JopO96tnwbsLSoKAU3ipseIA5tsNrdSWXIl7Gu6arE65eBecdkZ4t3s12EptaiwuoorSSP9rO9yQahF43hN6gsu5ZCQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
9.45165568e+08
unknown2
AAAABAAAAAEAAABRAAAAAgAAAFQAAAACAAAAPQAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/people/donald-j-trump
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
watermark
305419896

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 2200 rundll32.exe
7 2200 rundll32.exe
8 2200 rundll32.exe
9 2200 rundll32.exe
10 2200 rundll32.exe

flow	pid	process
3	2200	rundll32.exe
7	2200	rundll32.exe
8	2200	rundll32.exe
9	2200	rundll32.exe
10	2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2200	2176	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-1-0x0000000000290000-0x00000000002CD000-memory.dmp

Filesize
244KB

Download
memory/2200-0-0x00000000001C0000-0x00000000001F4000-memory.dmp

Filesize
208KB

Download
memory/2200-2-0x0000000000290000-0x00000000002CD000-memory.dmp

Filesize
244KB

Download