cobaltstrike | 2a69f324a5524c24e3280c7d6e573ee0854ae8a6e12efe42f1c8cea50999ba74 | Triage

Submit
Reports

Overview

overview

Static

static

7

frhasdtr.exe

windows7-x64

frhasdtr.exe

windows10-2004-x64

lumma.exe

windows7-x64

lumma.exe

windows10-2004-x64

picturefonts.exe

windows7-x64

7

picturefonts.exe

windows10-2004-x64

7

rundll.exe

windows7-x64

1

rundll.exe

windows10-2004-x64

setup.exe

windows7-x64

7

setup.exe

windows10-2004-x64

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 03:37

Sharing

Static task

static1

vmprotect pyinstaller

4 signatures

Behavioral task

behavioral1

Sample

frhasdtr.exe

Resource

win7-20240903-en

lumma discovery stealer vmprotect

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

frhasdtr.exe

Resource

win10v2004-20241007-en

lumma discovery stealer vmprotect

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

lumma.exe

Resource

win7-20241010-en

lumma discovery stealer vmprotect

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral4

Sample

lumma.exe

Resource

win10v2004-20241007-en

lumma discovery stealer vmprotect

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral5

Sample

picturefonts.exe

Resource

win7-20240903-en

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral6

Sample

picturefonts.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral7

Sample

rundll.exe

Resource

win7-20241023-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

rundll.exe

Resource

win10v2004-20241007-en

cobaltstrike backdoor trojan

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

setup.exe

Resource

win7-20240708-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

setup.exe

Resource

win10v2004-20241007-en

stealc workbaza discovery stealer

windows10-2004-x64

5 signatures

150 seconds

Report Analysis Logs

General

Target

rundll.exe
Size

1.6MB
MD5

b6f38a50620db20ac5c231f924f3b4a5
SHA1

635d79bbab78af66e561e2146ed0f5926dc886fb
SHA256

24630db019f0de35f81c0a712d62ed04db084cdd287ea803f588e0f808186f98
SHA512

bf6fa80d2e973faab2bf8cdf35aa7a4975b511fe2175a57b4ba86c670a49fc17a8c2aa6389578df1cf6a065effc0057384873ff6215eca0cb693e77a3f8272ed
SSDEEP

12288:ehJK5SJT91q5uM97uyuYpxwu5T1v+rMORuIDJI4yN/6YYJNtuX3e9ifzRBexvVIx:kJP3qeyff5k+5/EP0+9ue52kaX58oj

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://79.110.52.22:443/components/as.png

Attributes

user_agent
Host: tgmcheck.com Connection: close User-Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

Processes

C:\Users\Admin\AppData\Local\Temp\rundll.exe
"C:\Users\Admin\AppData\Local\Temp\rundll.exe"
1⤵
PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-1-0x0000021DF2FC0000-0x0000021DF2FD0000-memory.dmp

Filesize
64KB

Download
memory/3616-0-0x0000021DF2FC0000-0x0000021DF2FD0000-memory.dmp

Filesize
64KB

Download
memory/3616-2-0x0000021DF2F60000-0x0000021DF2F61000-memory.dmp

Filesize
4KB

Download
memory/3616-3-0x0000021DF2FC0000-0x0000021DF2FD0000-memory.dmp

Filesize
64KB

Download
memory/3616-4-0x0000021DF2FC0000-0x0000021DF2FD0000-memory.dmp

Filesize
64KB

Download
memory/3616-5-0x00007FF71B7F0000-0x00007FF71B984000-memory.dmp

Filesize
1.6MB

Download

© 2018-2025

Terms | Privacy