cobaltstrike | 0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c

Analysis

max time kernel
133s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe
Size

2.8MB
MD5

aa01858bd6596a339fba887aafb270b0
SHA1

2a38c7beb03a633ed396f393404191aff2b186a9
SHA256

0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c
SHA512

23a8e5c6ad9e6fbec2006dc7f8cf53be9a9cb08c3c4b95ec05530db126c8aa6bc9fa2bfc37937fff68fe2cba945e6d7271cb2e302716f8eec748501d50a69dbf
SSDEEP

49152:9ORocsGjsxoAHT2tWCOcEf56epMddiqbi/R9/MAgwf8j6Nf1bm9jFQNqRLDIPHo:f9a02tWCRqedk/n0Agwf8j6NfJIDI

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://149.104.25.1:5541/cM5x

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) LBBROWSER

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Loads dropped DLL 3 IoCs

pid	Process
2240	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe
2240	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe
2240	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	2240	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2240	2008	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe	30
PID 2008 wrote to memory of 2240	2008	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe	30
PID 2008 wrote to memory of 2240	2008	0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe	30

C:\Users\Admin\AppData\Local\Temp\0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe
"C:\Users\Admin\AppData\Local\Temp\0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe
  "C:\Users\Admin\AppData\Local\Temp\0122dc62d013e938ceeb5416d1dd2281b0031fc23734426847e6662050bb143c.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20082\_ctypes.pyd

Filesize
131KB

MD5
9a69561e94859bc3411c6499bc46c4bd

SHA1
3fa5bc2d4ffc23c4c383252c51098d6211949b99

SHA256
6bbde732c5bcb89455f43f370a444bb6bca321825de56f9a1f2e947b0a006f1c

SHA512
31d9e3844f1b8e72ec80acd1e224a94d11039c130e69c498a668e07e0d8bba8d1ed1ebe0b7a16376ca597d0e2b74a0d5e3bf53d1cbadf5bf099d3bf78db659a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20082\base_library.zip

Filesize
777KB

MD5
0e6058a5f76271c2e67f526ecf1dd1e7

SHA1
9266d66b72db5e3d1dfcf7e8be0dd2dc409cb53a

SHA256
ab3b96de6190cd8aa7d49f41530047e7aa39e4d620d79665bd88e4e1beed6a62

SHA512
f71f8d85974520546951105e0ccb6c49df0f561498648182eec6c983e27d775a7d8b38ca4b01b46c9f0660d974291fc78ed57042ab0a543273aac6a34fd37323

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20082\python37.dll

Filesize
3.6MB

MD5
86af9b888a72bdceb8fd8ed54975edd5

SHA1
c9d67c9243f818c0a8cc279267cca44d9995f0cf

SHA256
e11aa3893597d7c408349ebb11f47a24e388fd702c4d38b5d6f363f7ad6e8e5f

SHA512
5d8fd9040f466e23af7f17772e3769ad83c5f55f8c70dcc3cfb1f827e105f0f4e6133f0e183fabc67dd44799495c47f931bf92546342b30b9c4a5c2b4aeee7c7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20082\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
memory/2240-14-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads