cobaltstrike | 4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe
Size 222KB
Sample240826-kw1pgaxcnn
SHA256 4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d
MD5 c7252d2cf01ef6649f68b3ecad41f076
SHA1 d22460082ca5dc8ba886b7322a0693d6f14753e3
SHA512 287fc960e93de0e71e1f129f6830b35ff836ce1e48aa154b9c895ba6ee07594018c8b091e2fa409f934eb16ceaf271f541ece8527aa679bd5b162c57474ada9e
SSDEEP 6144:sx4EKOcREjfddvzCeVubrmCngalRpdFStK2dUFA:c4PdRgfSrAmpdMK2dUF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 391144938 backdoor discovery trojan vmprotect

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://192.168.147.146:4444/ptj

Attributes

access_type
512
host
192.168.147.146,/ptj
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
4444
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5VHTAu6nd80pxW6xX4s6qO0NGIs8eT1kSluGue2yRTavh2WZN+s9y/2+o3788uHV7q9Zd+6ClJES2Rewc3w3LDAQfHQCBSi6xf06Ifp1vvxOFsiOJepU1aJUIp7ftTMwOTaqTBe+drrpj6VAtAv2igWKPrlzy2WIUti72UrDqGwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) LBBROWSER
watermark
391144938

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4120-0-0x0000000000400000-0x000000000048B000-memory.dmp	vmprotect
behavioral2/memory/4120-1-0x0000000000400000-0x000000000048B000-memory.dmp	vmprotect
behavioral2/memory/4120-4-0x0000000000400000-0x000000000048B000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4120	4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe

C:\Users\Admin\AppData\Local\Temp\4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe
"C:\Users\Admin\AppData\Local\Temp\4be5b469a73af55e9562c2f60748f0ee3ca01771e986b99e3d988f2f0fed989d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-0-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/4120-1-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/4120-2-0x00000000006D0000-0x0000000000707000-memory.dmp

Download

memory/4120-3-0x0000000000710000-0x0000000000751000-memory.dmp

Download

memory/4120-4-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/4120-5-0x0000000000710000-0x0000000000751000-memory.dmp

Download

memory/4120-6-0x0000000003D80000-0x0000000003D82000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads