cobaltstrike | aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 19:11

Target

aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe.dll
Size

24KB
MD5

ee7aada6b80832d7a48a942a38317559
SHA1

599b21569b8e8be062303e8ad476f4f886dbe0c5
SHA256

aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe
SHA512

a5a7cebac2cea38b12a9e983b6eb75dccfaf3dae92cac2d6f3a54a7efae549a27fa581656541984267a79a4ec6d11caada629040983690a96d79886907f4d28f
SSDEEP

384:A6wL584Z+fsGHpXjWXoZVNBCpz0XjjonCvTAlBwMpkvYDt6B:6fa1jWXobNApIXj8n8tMpMOt6

Score

10^/10

Family

cobaltstrike

http://119.91.195.178:20961/www/handle/docm

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) QQBrowser/6.9.11079.201

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 8 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 4996	2552	regsvr32.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4996	2552	regsvr32.exe	87
PID 2552 wrote to memory of 4996	2552	regsvr32.exe	87
PID 2552 wrote to memory of 4996	2552	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa9b7787058c20d3c09e4906cf85dd12077311fbb360385fb19acf2572d63abe.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  - Blocklisted process makes network request
  PID:4996

memory/4996-0-0x000001CE4C2F0000-0x000001CE4C2F1000-memory.dmp

Filesize
4KB

Download