cobaltstrike | 500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe
Size

8.5MB
MD5

0f023077d71e33d852515fab81709fc9
SHA1

3523a1ce388bd5a88432e81a5de2a75ea82db6d4
SHA256

500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532
SHA512

009c539faa6ec30b0b2937a973887a0b15794ce0bf09b74250932b7d11e9516e4a29e7d00acb0ee9ba3f25c93a295691cc851a6ba7516b4550fa6ee45bb8246a
SSDEEP

49152:bqXEV5Jf21tKNzJIgxDV/iGKzxFbYrIQc10H9u8:bqXOJf2f2tV/iGKzkno8

Score

10^/10

cobaltstrike backdoor discovery trojan

Malware Config

Extracted

Family

cobaltstrike

http://apt.freelinuxupdate.tk:2053/bootstrap-2.min.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Executes dropped EXE 2 IoCs

Processes:

go-memexec-391220227.exego-memexec-861662135.exe

pid process

2168 go-memexec-391220227.exe
2912 go-memexec-861662135.exe

pid	process
2168	go-memexec-391220227.exe
2912	go-memexec-861662135.exe

Loads dropped DLL 3 IoCs

Processes:

500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exego-memexec-391220227.exe

pid	process
564	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe
564	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe
2168	go-memexec-391220227.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exego-memexec-391220227.exe

description	pid	process	target process
PID 564 wrote to memory of 2168	564	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe	go-memexec-391220227.exe
PID 564 wrote to memory of 2168	564	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe	go-memexec-391220227.exe
PID 564 wrote to memory of 2168	564	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe	go-memexec-391220227.exe
PID 564 wrote to memory of 2168	564	500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe	go-memexec-391220227.exe
PID 2168 wrote to memory of 2912	2168	go-memexec-391220227.exe	go-memexec-861662135.exe
PID 2168 wrote to memory of 2912	2168	go-memexec-391220227.exe	go-memexec-861662135.exe
PID 2168 wrote to memory of 2912	2168	go-memexec-391220227.exe	go-memexec-861662135.exe

C:\Users\Admin\AppData\Local\Temp\500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe
"C:\Users\Admin\AppData\Local\Temp\500052cb8acffebe5d34d0eba53c84f30d8f6227273661985c654a8f06098532.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\go-memexec-391220227.exe
  C:\Users\Admin\AppData\Local\Temp\go-memexec-391220227.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\go-memexec-861662135.exe
    C:\Users\Admin\AppData\Local\Temp\go-memexec-861662135.exe
    3⤵
    - Executes dropped EXE
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\go-memexec-861662135.exe

Filesize
328KB

MD5
58336a3811207c8d3f57709317b172e9

SHA1
221f507292989dbd52c3a26df4d3fb9f1d80af7a

SHA256
a3afb74b961f0b9b6e484166d61b92eb8ab2a41f0a88cc11f02c6b316ebee74f

SHA512
99b0ccc043f20339d82bcdd5634dfa4ea863fb466121c67c663c12247d1f442cc0868b4cdd06aba64e3684015aa364af9d2ffc8567f14b585efa79d97cd43b80

Download Submit
\Users\Admin\AppData\Local\Temp\go-memexec-391220227.exe

Filesize
3.2MB

MD5
1e1735bff2d3c91b471c36ea563014b8

SHA1
5eb30dfa2fdc41d34c0a52da384aa531331c6343

SHA256
84c8bb6a84391404ae1ab0dc9760d87a35253bb4638b20156eb3dc1aeccb8e99

SHA512
964251a36457435095fea7b674d2eb30ea6fcb9ef66fa1ccfa6dc884beac6d577fdd26b0d45e2855d3ab77707db4d9b39410749fd61b395cf71a30c35d5cfaf5

Download Submit
memory/2912-11-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2912-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download