cobaltstrike | e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe
Size

291KB
MD5

f67591721354565dabe3fe735220c6f0
SHA1

80fe9705193ced60398d8ae688e80f4df403c0ea
SHA256

e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732
SHA512

45cb3ae86df2f816e94b904a2f6a4339edcbe4e8a3dc635b8e6da6c26b3809d771bc4d865a1250ee2e5302311b3ad25fbb7d870f2188831584bed35421391e3c
SSDEEP

6144:KiubWrNSOetO6cprlQAOWizGLIoSd8nUbbq:dubsNSOetfARQAPyGUWYbq

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://192.168.220.128:80/JStL

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe

Executes dropped EXE 1 IoCs

Processes:

gpt.exe

pid process

5088 gpt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5088	gpt.exe

Modifies registry class 1 IoCs

Processes:

e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe

description	pid	process	target process
PID 4136 wrote to memory of 5088	4136	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe	gpt.exe
PID 4136 wrote to memory of 5088	4136	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe	gpt.exe
PID 4136 wrote to memory of 4984	4136	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe	NOTEPAD.EXE
PID 4136 wrote to memory of 4984	4136	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe	NOTEPAD.EXE
PID 4136 wrote to memory of 4984	4136	e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe
"C:\Users\Admin\AppData\Local\Temp\e5af8ae15c2e63b6fc394a1fab48e4041312d70d1437f4cf7810535c5a410732.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4136

C:\windows\temp\gpt.exe
"C:\windows\temp\gpt.exe"
2⤵
- Executes dropped EXE
PID:5088

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\windows\temp\简历.txt
2⤵
PID:4984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\gpt.exe
Filesize
19KB

MD5
b921ecfa820bb9ffafb7032ab19dbcb6

SHA1
2fa6a67d48d4da74062f97988f60cb28c2f915c6

SHA256
04c8f231e89fee94587c6a9e5b3161a4ffee8e4f8333fc455ab4eecdb94dd6fe

SHA512
07ca37673df01e7c7f50fc2190b445428fbd3e3427ee069aa4028a7bb095b72c6a717c11b8bcd3d87a0cfaba551d80c902ec4b2ac4825f5a8dee8bced6ac517f

Download Submit
C:\windows\temp\简历.txt
Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
memory/5088-13-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/5088-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download