cobaltstrike | 9737c963c888d2df3b767ef7c77265c47decabc4b71210146be9e9f81914ecf0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 12:11

Target

CRYPTSP.dll
Size

282KB
MD5

9969eec1d2e99a6535f5fc62b2acc78e
SHA1

212b0d900473ff811bd6d4f1dbd2a2f732574763
SHA256

27a1a83fc410bb51c4fa943de18fc93f1081a5703941808e01a12ef176735c4e
SHA512

9ea50296718ebccc4a9bfcc2fce61e47b74c00febf4f50dd159c4852fbdf4a2fa06cd0fdbdfde653078c4763b8b4917b43499aa671dd2b2ca30029f8c3abeb14
SSDEEP

6144:e5yKlTiyDU15/TKvqXNBfPmLno+bG+4ohEzP+59:e5ni7//+6feLTGroiK9

Score

10^/10

Family

cobaltstrike

http://service-61oc67uo-1327454768.gz.tencentapigw.com.cn:443/Content/js/cookie/jquery.cookie.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 3140	3272	rundll32.exe	82
PID 3272 wrote to memory of 3140	3272	rundll32.exe	82
PID 3140 wrote to memory of 4292	3140	cmd.exe	84
PID 3140 wrote to memory of 4292	3140	cmd.exe	84
PID 3272 wrote to memory of 4564	3272	rundll32.exe	86
PID 3272 wrote to memory of 4564	3272	rundll32.exe	86
PID 3272 wrote to memory of 4564	3272	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CRYPTSP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c calc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:4292
- C:\Windows\SysTem32\notepad.exe
  C:\Windows\SysTem32\notepad.exe
  2⤵
  PID:4564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4936

memory/4564-0-0x000002579DAD0000-0x000002579DAD1000-memory.dmp

Filesize
4KB

Download