cobaltstrike | 2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe
Size

1.7MB
MD5

71eb13eb1390d8cfd2abbc453e5a3030
SHA1

989772d227c27bf7e47e4b0d89492777514b4af5
SHA256

2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c
SHA512

f093949be937acb2417a9cddb1321ee5cce08304ab65e6f27a173e09eff9b0ca6cc88fb2aabfcfffeedf7afabd3ee4f99c1ad1d0c98b043a8aee17e9bf50c2cb
SSDEEP

49152:4ZB1G8YQd3Ik9S91M2V/tZ8YzBigAKScJViCAZ:m3Gid3d9CM2V/tZhzQpcJVVAZ

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://192.168.88.129:6666/tbEB

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

Executes dropped EXE 1 IoCs

pid	Process
2644	beacon.exe

Loads dropped DLL 2 IoCs

pid	Process
2280	2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe
2280	2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2644	2280	2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe	30
PID 2280 wrote to memory of 2644	2280	2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe	30
PID 2280 wrote to memory of 2644	2280	2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe	30

C:\Users\Admin\AppData\Local\Temp\2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe
"C:\Users\Admin\AppData\Local\Temp\2210b4049adfc3b0e043b7be576860970e43ef66f71a4d57244bc4bc6e6c936c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Public\beacon.exe
  "C:\Users\Public\beacon.exe"
  2⤵
  - Executes dropped EXE
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\beacon.exe

Filesize
19KB

MD5
0aa22540bf27bc4a5a129e62a65aa041

SHA1
c0f0c30bd46955aaff9965be5b5e8e6d8e07b1c8

SHA256
21a50932c0a565053426c05ab5d37f6cafe8a822843866733330e8ca333b39e3

SHA512
5709d764d0da87dce377337cf7559701a22042a6734288648229eb2979c83de088efea09c23d6ddfed2cb1773c44ee1a756e099856a4cc20e57697feb6956d43

Download Submit
memory/2644-12-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2644-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download