Malware Analysis Report

2024-08-06 10:57

Sample ID 240510-y5zenaah69
Target 5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae
SHA256 5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae
Tags
cobaltstrike 100000 backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae

Threat Level: Known bad

The file 5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae was found to be: Known bad.

Malicious Activity Summary

cobaltstrike 100000 backdoor trojan

Cobaltstrike

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-10 20:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 20:22

Reported

2024-05-10 20:25

Platform

win7-20240508-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe

"C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 20:22

Reported

2024-05-10 20:25

Platform

win10v2004-20240508-en

Max time kernel

131s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4952 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe C:\Windows\System32\notepad.exe
PID 4952 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe C:\Windows\System32\notepad.exe
PID 4952 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe C:\Windows\System32\notepad.exe
PID 4952 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe C:\Windows\System32\notepad.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe

"C:\Users\Admin\AppData\Local\Temp\5ce1dc45dc972fa5956365294a6c6fc97f3c8b01a9263db743aa5b7d3cde02ae.exe"

C:\Windows\System32\notepad.exe

"C:\Windows\System32\notepad.exe"

Network

Country Destination Domain Proto
CN 8.130.52.13:9966 tcp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
CN 8.130.52.13:9966 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
CN 8.130.52.13:9966 tcp
CN 8.130.52.13:9966 tcp
CN 8.130.52.13:9966 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
CN 8.130.52.13:9966 tcp
CN 8.130.52.13:9966 tcp

Files

memory/2600-0-0x0000021FF1560000-0x0000021FF15A1000-memory.dmp

memory/2600-1-0x0000021FF3050000-0x0000021FF34C2000-memory.dmp