Overview

overview

10

Static

static

10

c1650824b0...f8.exe

windows7-x64

7

c1650824b0...f8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 05:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c1650824b059db6a23d79c9ecfa32fea7d7ca61111fedb95ec03570b6b4bfbf8.exe
  • Size 6.5MB
  • Sample240725-gjgjaasamn
  • SHA256 c1650824b059db6a23d79c9ecfa32fea7d7ca61111fedb95ec03570b6b4bfbf8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

  • cobaltstrike

C2

  • http://43.138.15.224:8001/jI5u

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Loads dropped DLL 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1650824b059db6a23d79c9ecfa32fea7d7ca61111fedb95ec03570b6b4bfbf8.exe
    "C:\Users\Admin\AppData\Local\Temp\c1650824b059db6a23d79c9ecfa32fea7d7ca61111fedb95ec03570b6b4bfbf8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\c1650824b059db6a23d79c9ecfa32fea7d7ca61111fedb95ec03570b6b4bfbf8.exe
      "C:\Users\Admin\AppData\Local\Temp\c1650824b059db6a23d79c9ecfa32fea7d7ca61111fedb95ec03570b6b4bfbf8.exe"
      2⤵
      • Loads dropped DLL
      PID:716

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\_ctypes.pyd
        • Size 124KB
        • SHA256 4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\base_library.zip
        • Size 1012KB
        • SHA256 1b63f643913ffa59240c8aeb691b4139bab74dfb15d11084c574342c41b82db6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\python39.dll
        • Size 4.3MB
        • SHA256 f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35122\ucrtbase.dll
        • Size 1.1MB
        • SHA256 9a2fe283527a861a1ffbde865ca150452d9a116f06134873468251e7b3a2b740
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/716-65-0x000002129A000000-0x000002129A001000-memory.dmp
        Download