cobaltstrike | 8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
Size

6.1MB
MD5

fdf7978c3aed9fe50f818eea32c2d6e1
SHA1

06c1d9b55ebf9853f9ad26bea88036ff9b3c8c4f
SHA256

8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82
SHA512

d65b682bedde89864228d05e754e2dc040e778750a5fa35bb119b8ae569c67ad90588350477109c5428568d3ab0bc8a24e0954b7268acb6597b88b8a333ace23
SSDEEP

196608:XNFO9onJ5hrZERkB2WZufOuD9L7CTUKytL0p:dFO9c5hlERA2WmfDZccLw

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://192.168.15.23:80/mt_show_1.8.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://2aede.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Loads dropped DLL 22 IoCs

pid	Process
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
2572	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2572	2072	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe	30
PID 2072 wrote to memory of 2572	2072	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe	30
PID 2072 wrote to memory of 2572	2072	8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe	30

C:\Users\Admin\AppData\Local\Temp\8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
"C:\Users\Admin\AppData\Local\Temp\8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe
  "C:\Users\Admin\AppData\Local\Temp\8023f61dc9847a31422c4096faeb42d7ceaf907230a19dcf8a68fa25ff7cca82.exe"
  2⤵
  - Loads dropped DLL
  PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20722\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\_ctypes.pyd

Filesize
123KB

MD5
4d13a7b3ecc8c7dc96a0424c465d7251

SHA1
0c72f7259ac9108d956aede40b6fcdf3a3943cb5

SHA256
2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed

SHA512
68ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
a855f5ffc6690c1bd1706d1dae6251a2

SHA1
075f84148285a2b61808d3094c8e1fe35466d59f

SHA256
98b4b6a29374e68a383bd6e4b58cd76223335d38d2586c5a494466444811b75c

SHA512
35ee703d27e15e192a847f86c22ad613880e1e53296a1bc0ae2249b2a777a0bfe3695fd609278281e8b3e5621534a242c3d3a7bda48c7ab23e513b59ceeb889d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-core-file-l2-1-0.dll

Filesize
21KB

MD5
18a078bf6941f50fc3158b749441b9ce

SHA1
279e944990b2fb184a6d09e3e62f574751e2e9a7

SHA256
637e9a34044c366b9b004e62ee15aa4875e344a5a6b7634c803a40d95883d7cc

SHA512
bc45590aaa25264e2c9640f5a9a357d6b0cf88e9027fcf70fcad666a50cc309378ce9a49e0d02cdf299b2631b724e863e31061090d6ae7893db048afa6fb6943

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
8a52d5f941f257c581e856811586b887

SHA1
a510353c67126ec00d13a3f4c0b2e494394a2949

SHA256
6ce59c2de64b6195695e8754636cbe283a7af3ddb78acf32c3879d7d09aba4b1

SHA512
39bad27e61d9a694740556c8290739780ebd7cfdd1f909b85a37ef5c55bc3bd8f439cb6e26d77715649bb04ae701a02fc789535f0d23a5db9ca4a981a38fcb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
cb6102cdcd530e82f9a7f2579dd5be22

SHA1
8f1881ba356c8d7497580fc5efe2681200632cae

SHA256
f5c82a141bdc7929bb3d6d4196c0e8501f4a894fd65a435f8134c073134461ac

SHA512
bc9129d58c05991f4567d2ce64e5d5a5ecaa876503ee0644ac61b67fea4b794251cd0f1d1631ef63e8f530a0db074684cde9f35d852ddcb50a9b02d641a63d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
7f0a0a190aea88884088bd09d36a2c4b

SHA1
f8d3039deda1f7fc025f4e4cbbc3010cba3762b3

SHA256
a202f21169cc103c019019d3cbc05c3549a8dbac6eed0ecb4e5281e36f028a26

SHA512
5f75ad8016ee9649cd565e27930f951cfc7b40b468ca7a5792578301ff2a16825ca2a98103ba8f4e6d8feb761655be1d8c24fa9e1d539bec6c3a5b3a04f8e9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
f296c2faa7817165685921a7c29ef444

SHA1
c8182dade7f1089074410026b135ca07a39261bd

SHA256
ea8ad551e8944389ce502cb8d5f979d243af7784ce7382fa18a04a9de2f7b2d1

SHA512
815225889ee4286c26bd004a22fd1fdb43cf18655d12cf18ae92f1e70445e9daa8a55207a971299ecd6adf1f848cf3279a4c6c966f371a208c818744d13041fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
ec929cdb876f15a5b1c56651a132e70c

SHA1
171da7a89e177d08873b7ef73c0b8b0e0c30bb96

SHA256
eb41bf23e10405efcad8bb3eb8972f431394113324717386362ac6406a5c6d75

SHA512
a830d7b5aedab56e5c959af944cf3a5d1c81fbfbc58dd9b18a56aafb9dc10cdc21ae6f524819c6a4e17ab06a139c73068f927cf6a675131cfebccbcf1fc35c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-environment-l1-1-0.dll

Filesize
21KB

MD5
6b1a8f966512f0fb05b07d557a079476

SHA1
c3713af0e4ada371710a3ba456fcdbe0547d86e2

SHA256
294bca6dcb6455e9027b527aae42ed5aa04d5ae769cb897cb36a150b40a6fa26

SHA512
0f977caa8cdd07b3cd5fefa6bb554755289da93199f479d9ee30f9e7251c48dc1ac9fdfda23146075fcde1f1e36a9553d9d6cbfdec1994e1e3ab54ff322b0bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
21KB

MD5
35cc322c04032419445b3ee052ce85fc

SHA1
8b1064117c231a736805190d1453ae8b61ef1e9e

SHA256
a60dbd92bc1e1e06035d6aeef821d71dd06de7e15b5536110048233dd523a9a2

SHA512
6549e9dd6281f2f3ae8b29cab59999da2f3cfcc9d5a58900ccda40c28a16d56dd6aa0c35d9014f72b00eca4e8fa3f3e6c4488aa53090fe3f80065f5db01e5e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
ba9303ddc07281252d1c56faa85d9716

SHA1
88c4256b84fffd7d2c1c4920a90b3cf8423252f1

SHA256
20ce58e1990ac2f726466e234e6a6ef4dfae97f8cb1571a0a4b1bd74df87dfdd

SHA512
758f66b8931fccf436ca67b34166700f9d9bc5fee19a6ec1569b5e8f4af9821b0d07753931b7b51907cca94b449b7054a3ec8595161b5cbfaaf5b1d416402a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-locale-l1-1-0.dll

Filesize
21KB

MD5
0774cf132b254ba3271bd9ef48259165

SHA1
76a7ab15b3acbf3b12066cc494c800d3053e4307

SHA256
fe617cc8748560a1e12e58559fdf192c5888babff4ae62e386617293d5fc20b0

SHA512
d747dc4cc1fc5e29fed84e5234a73a404671f04708aaaca454c0cb4c4345c920246480eb75c7f8275a6742347f4baf6b2ab7c58b408164b18879cf5b1f546a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-math-l1-1-0.dll

Filesize
29KB

MD5
87789f1e4ac145980437a907f7ec1984

SHA1
85d146e1610ec2f5b289c27a626edafad94a64f5

SHA256
655965eca578ae6b0afedd0ce2a424a3f6e9b3e624dd0d55ce67bc7df75b3b6b

SHA512
0be4dd47a3a003c10e6f7f89b5899268400a43b25e8f16957f13154771ae809e17def48d5babaddad81320760d3f994a7446b06498bc594829b69e8c212166b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-process-l1-1-0.dll

Filesize
21KB

MD5
4a5ee7c5ed85ad19c0c05a99f563165a

SHA1
1f199631b516ab553bef7fcdcf216648b9d77173

SHA256
2292e2b873f90645e2d6e94e83c748f301773a2c12c3824e80581aefd869cc9c

SHA512
a04b225e2bb1637ee4a5fdfabc2628daade078f555f81fbc7eff3643eb544e2be8c5e60878ee9e8e1ba33014b468890c7490c3a99b4c464f13df0cb862885376

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
25KB

MD5
554da00be256a94c51a4bdf92387ac2a

SHA1
fed494412793c9a3f78686aae38e34e0ab910043

SHA256
84ce7e29868776de9939938d5c3091736669ebad4f063f5e83df0299b474e5ed

SHA512
3244cf3a19a132c1f17b94fc433c6b033247865c8f66e2f7b3456e23e1f23bd9c934b13d1f8873ae220b9dae14a06c998ef9589cd8a1140392fd1dac77c82780

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
25KB

MD5
cae87585a8e25d1b0754be0b397d065d

SHA1
a39b2373cb2d412d4398c531ee2e1c64cd5683f6

SHA256
acd08d06dfc981071142a851913e55aa253926c12b5b9d73649b832a4bfd0dd9

SHA512
9f840b316b19058047e06294df8b43460adc832d6d61274b66bd8491fd78ca53dc944c701f7bdd78c04c08eb11598f1c33cafc94df54b1286bef7656e29f3aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-string-l1-1-0.dll

Filesize
25KB

MD5
395e487fa98b314a1a703310917f8476

SHA1
36f30e8d4f530ad402d1d563a7e25b97b25ad34b

SHA256
db897e58b7d327a059db263af2f1be1eff58176e3bcdb82aa801e2d69fd2293c

SHA512
c7d9e1b22f5e79c459a916f48dec9b0c93c0dbf1909bbd3e99f6f44dd61bf38ff77bed5a9963fda8367a238e72cd79fa19c6642506dc8438203199800e794c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
939cee7266426363a65f2fbb02699d8d

SHA1
ec2c10e80992021283ec49badd64148f58d51100

SHA256
44705d9b3271d9db307f92c7c2764a98db5819e670897dbfc95beb386a1840bb

SHA512
85bee7a8b81c7ba122832e26f4e2d826eebb27b017917404d69a38e2a016216d1556f1416019c45e6aaf7fe9e7a8851d4359bd2ed443f4892395a42295b33c5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\base_library.zip

Filesize
1006KB

MD5
108a230ea68b03c5e4cd2a63c7b61cfb

SHA1
1e830ada31660bb25959fe168c2c888f84a07951

SHA256
e03a56fd6ee05d57f8160101660950a553f5eddb22897f10d69f28811b62ed52

SHA512
ef8c8b1e935af5e3b4097d7f61c927c1c95d15a09b85d5ff0f7e2e79390fe63d1ed992bc0ff4f298bb678336473f7b60cdfede65af681f4960ca8b26ac1f7684

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\python38.dll

Filesize
4.0MB

MD5
3cd1e87aeb3d0037d52c8e51030e1084

SHA1
49ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af

SHA256
13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8

SHA512
497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20722\ucrtbase.dll

Filesize
1.1MB

MD5
05f2140c1a8a139f2e9866aa2c3166f1

SHA1
9170cff11f3b91f552ac09a186a3bae7ea7cda25

SHA256
048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733

SHA512
bdc7daf31fa9261967cab58c928fe5146b53c96f9b7c702ae8ee761b2652702d9f34dabf4252b7b580311d6dd4d2914ea7721296bebcea3344006eaa0f99f2ed

Download Submit
memory/2572-99-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads