cobaltstrike | 9228189d8bdec3138b0d06459b78fa619670c278209175e72a3c3e4c14bef888

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
Size

3.8MB
MD5

d3e85db152a983d350c936d99af278a0
SHA1

c5fdadae7baff5634b25ebfd7053e565d1fe9fb0
SHA256

9228189d8bdec3138b0d06459b78fa619670c278209175e72a3c3e4c14bef888
SHA512

a1dc23c5659804d98e5c7cd8fce1ad6cb6c30061dc67557792babf6db5f337136b58cc890296b9f8a7753849408270287289deb6deebdb790b7b2174995b9f38
SSDEEP

98304:Zt6J4X3ITSofR5N1yvA1pYAWBcrKFrSdSn0sECcnbtJK:ZQKWSofR5vyvCYIeSrs2btk

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://101.43.127.218:7777/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Loads dropped DLL 3 IoCs

Processes:

2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe

pid	process
3048	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
3048	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
3048	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe

description	pid	process	target process
PID 1644 wrote to memory of 3048	1644	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
PID 1644 wrote to memory of 3048	1644	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
PID 1644 wrote to memory of 3048	1644	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe	2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_d3e85db152a983d350c936d99af278a0_ryuk.exe"
2⤵
- Loads dropped DLL
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16442\MSVCR90.dll
Filesize
629KB

MD5
552cf56353af11ce8e0d10ee12fdcd85

SHA1
6ab062b709f851a9576685fe0410ff9f1a4af670

SHA256
e88299ea1a140ff758163dfff179fff3bc5e90e7cfbbd178d0c886dbad184012

SHA512
122f389e7047b728b27f3c964d34b9c8bcae7c36177122e6aa997a6edadad20b14552879f60667a084d34727cb2c85dd5534b6fa7a451f0ab33555b315335457

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16442\python27.dll
Filesize
3.3MB

MD5
7d70c8d8fc3c80a0dd514a25ebcab3d7

SHA1
1bc65d764a012bba355d3a8f57a11e18fd3bb636

SHA256
3cd15cca3e7db57da0a4808b6602261763c5e31f807083c59deaffcc0649b743

SHA512
5e03aaec836bd429fe7577628161af4a18ee881338fd31f5634aec953f473ba078a888d6fa5af0d7a091048fa8516de28adf649a81f4a6b52325cb85a71ccf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16442\shell.exe.manifest
Filesize
1KB

MD5
6f761c92fd4d1048dd26377488e5510c

SHA1
d13984fd32cd86e614e9714aea1b25a868f4d078

SHA256
94e1be0539549100d95ba3ecdf0e707ae0c67d6524163615850b9aef2acab391

SHA512
5c208feb0d733c41ead10e9ab158effa4fecde8da06fe7b359906677fab661af564413d6f9316925d2a25d5a5a21384aec546d3e754ac3b8397052fc682670bd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI16~1\_ctypes.pyd
Filesize
119KB

MD5
77be51b28c575526d749e2a91f3a4a83

SHA1
6a3a1b24696f5e82813eb5ae633fb4a3543d0543

SHA256
6f450435edb2b78504f166044aa45e87cd19670789dfacdb1074db7f934ab2a6

SHA512
2fb131ed48ac08e51c485d8ce5f16c09c7aa7d3ababb02b01198cc5ece15c33f161af25b7ed3130ee63676dedc0ffb06c40eeb2a6c8654d89ba3539a5242cf6a

Download Submit
memory/3048-18-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download