cobaltstrike | aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe

Analysis

max time kernel
131s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 19:11

Target

aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe.dll
Size

24KB
MD5

ee7aada6b80832d7a48a942a38317559
SHA1

599b21569b8e8be062303e8ad476f4f886dbe0c5
SHA256

aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe
SHA512

a5a7cebac2cea38b12a9e983b6eb75dccfaf3dae92cac2d6f3a54a7efae549a27fa581656541984267a79a4ec6d11caada629040983690a96d79886907f4d28f
SSDEEP

384:A6wL584Z+fsGHpXjWXoZVNBCpz0XjjonCvTAlBwMpkvYDt6B:6fa1jWXobNApIXj8n8tMpMOt6

Score

10^/10

Family

cobaltstrike

http://119.91.195.178:20961/www/handle/docm

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) QQBrowser/6.9.11079.201

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 7 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 2376	2684	regsvr32.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2376	2684	regsvr32.exe	30
PID 2684 wrote to memory of 2376	2684	regsvr32.exe	30
PID 2684 wrote to memory of 2376	2684	regsvr32.exe	30
PID 2684 wrote to memory of 2376	2684	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  - Blocklisted process makes network request
  PID:2376

memory/2376-0-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2376-2-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download