cobaltstrike | 9c11c097d708312b0a43173749d4eb68cec4f8d4a4102e1345c0e80789da3e8c | Triage

Submit
Reports

Overview

overview

Static

static

1cb080c3d6...ea.exe

windows7-x64

1cb080c3d6...ea.exe

windows10-2004-x64

2161f38eb7...70.exe

windows7-x64

2161f38eb7...70.exe

windows10-2004-x64

2705528029...00.exe

windows7-x64

2705528029...00.exe

windows10-2004-x64

49299f91e7...9f.elf

ubuntu-24.04-amd64

4

6f881e1052...93.exe

windows7-x64

6f881e1052...93.exe

windows10-2004-x64

a8a1a9e80f...ef.exe

windows7-x64

a8a1a9e80f...ef.exe

windows10-2004-x64

e52067c5c5...a6.exe

windows7-x64

e52067c5c5...a6.exe

windows10-2004-x64

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 14:55

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

1cb080c3d69281ff2af28a3b9f448ba493bba28b1c2fde989d5fe91eef4689ea.exe

Resource

win7-20240903-en

stealc save credential_access discovery evasion spyware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

1cb080c3d69281ff2af28a3b9f448ba493bba28b1c2fde989d5fe91eef4689ea.exe

Resource

win10v2004-20240802-en

stealc save credential_access discovery evasion spyware stealer

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral3

Sample

2161f38eb7e940f7dadbf1cff93e3219846ad9dd1d181aceadddd9b1f549bf70.exe

Resource

win7-20240903-en

lumma vidar c8450254a9a0920212cb81ae7f386da3 credential_access discovery spyware stealer

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral4

Sample

2161f38eb7e940f7dadbf1cff93e3219846ad9dd1d181aceadddd9b1f549bf70.exe

Resource

win10v2004-20240802-en

lumma vidar c8450254a9a0920212cb81ae7f386da3 credential_access discovery spyware stealer

windows10-2004-x64

20 signatures

150 seconds

Behavioral task

behavioral5

Sample

27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700.exe

Resource

win7-20240903-en

stealc default discovery stealer

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700.exe

Resource

win10v2004-20240802-en

lumma stealc default credential_access discovery spyware stealer

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral7

Sample

49299f91e7332c216e492d160c690a529b1b644bfd5879eefaf2ae37e2ea3a9f.elf

Resource

ubuntu2404-amd64-20240523-en

ubuntu-24.04-amd64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

6f881e1052c12c0f98f059f796602945b01a359c8d6154eb0e731dd6309a5f93.exe

Resource

win7-20240708-en

njrat discovery evasion persistence privilege_escalation trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

6f881e1052c12c0f98f059f796602945b01a359c8d6154eb0e731dd6309a5f93.exe

Resource

win10v2004-20240802-en

njrat discovery evasion persistence privilege_escalation trojan

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral10

Sample

a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef.exe

Resource

win7-20240704-en

cobaltstrike 0 391144938 backdoor trojan

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef.exe

Resource

win10v2004-20240802-en

cobaltstrike backdoor trojan

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

e52067c5c5842359f70b1196fd0ed1b9e119ae8eb11408f2a08f0487dc2d21a6.exe

Resource

win7-20240903-en

discovery evasion execution trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral13

Sample

e52067c5c5842359f70b1196fd0ed1b9e119ae8eb11408f2a08f0487dc2d21a6.exe

Resource

win10v2004-20240802-en

discovery evasion execution trojan

windows10-2004-x64

14 signatures

150 seconds

Report Analysis Logs

General

Target

a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef.exe
Size

19KB
MD5

dc66a0481a259a5c8820880822ff0b3a
SHA1

cbf0988817adcdf51562a519b1d7d4e5c68e5bf5
SHA256

a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef
SHA512

508662d93c5b14f18aea08759f32f12a281161d5e3627dfd63447f2e1e3719c8acea15b9f35c52bc5ba99af67f486488c0c51a2203867b88731e9e65f03abe78
SSDEEP

192:bV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2OcJWF8qa1Dojjgi:1qaCF31cix+Dc4zjbjFF46gi

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://47.239.242.141:9999/s9bO

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASB)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Processes

C:\Users\Admin\AppData\Local\Temp\a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef.exe
"C:\Users\Admin\AppData\Local\Temp\a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef.exe"
1⤵
PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1580-1-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

Filesize
2.0MB

Download
memory/1580-2-0x0000000003D30000-0x0000000003D32000-memory.dmp

Filesize
8KB

Download
memory/1580-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1580-4-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

Filesize
2.0MB

Download

© 2018-2024

Terms | Privacy