Overview

overview

10

Static

static

3

96a9f0c93d...bb.dll

windows10-2004-x64

10

96a9f0c93d...bb.dll

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/09/2026, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb.dll
  • Size 485KB
  • Sample260907-hfl52afc75
  • SHA256 96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoor297099651cobaltstriketrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 297099651

C2

  • http://ads-461.global.ssl.fastly.net:443/gtag/js

  • http://advert-581.global.ssl.fastly.net:443/auth/analytics.readonly

  • http://alphabet-106.global.ssl.fastly.net:443/analytics/v3/data/ga

  • http://alphabet-482.global.ssl.fastly.net:443/gtag/js

  • http://alphabet-604.global.ssl.fastly.net:443/gtag/js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    ads-461.global.ssl.fastly.net,advert-581.global.ssl.fastly.net,alphabet-106.global.ssl.fastly.net,alphabet-482.global.ssl.fastly.net,alphabet-604.global.ssl.fastly.net

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAgQWNjZXB0LUxhbmd1YWdlOjogZW4tR0IsZW47cT0wLjUAAAAKAAAAZ1JlZmVyZXI6IGh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZT1ocCZnc19sY3A9Q2dad2Mza3RZV0lRQTFDTkFsaS0mc2NsaWVudD1wc3ktYWImdmVkPSZ1YWN0PTUAAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAUAAAAGZ3NfbHBjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACQAAAAp0PXBhZ2V2aWV3AAAACQAAAARqZT0wAAAACQAAAAxfdT1ZQURBQUVBQn4AAAAKAAAAFkFjY2VwdDogaW1hZ2Uvd2VicCwqLyoAAAAKAAAAH0FjY2VwdC1MYW5ndWFnZTogZW4tR0IsZW47cT0wLjUAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAACBSZWZlcmVyOiBodHRwczovL3d3dy5nb29nbGUuY29tLwAAAAcAAAAAAAAABQAAAANhaXAAAAAHAAAAAQAAAA0AAAACAAAACXRyYWNraW5nPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    14592

  • polling_time

    37000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\gpupdate.exe

  • sc_process64

    %windir%\sysnative\gpupdate.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNcWX0PvzsyoVXY9DSkf6RP4/285/uunRWJQRbcKTzij2Z1hSt2rQ8M566wXzc7g4D1kk4VKGQ+XXp2Jrk7weNJoPzP3EP3M0sB6nx+ENdBHqWkz92Xq3M8e6oyW8PC19h/80k+uYgQ4FwHEVmo5hKGR6SoH8ftLptFGMVV8mv3wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.084953856e+09

  • unknown2

    AAAABAAAAAEAADizAAAAAgAAHTcAAAANAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /v4/reports

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36

  • watermark

    297099651

Signatures

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\96a9f0c93db3a46322fde6548a4aba3e537533e6e36ae29c980913c628f0acbb.dll,#1
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Windows\splwow64.exe
      "C:\Windows\splwow64.exe"
      2⤵
        PID:2512
      • C:\Windows\splwow64.exe
        "C:\Windows\splwow64.exe"
        2⤵
          PID:2332

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2332-9-0x0000000002750000-0x0000000002BC2000-memory.dmp
            Download

            memory/2332-10-0x0000000002750000-0x0000000002BC2000-memory.dmp
            Download

            memory/2512-2-0x0000000000190000-0x00000000001D1000-memory.dmp
            Download

            memory/2512-5-0x0000000002140000-0x00000000025B2000-memory.dmp
            Download

            memory/2512-11-0x0000000002140000-0x00000000025B2000-memory.dmp
            Download

            memory/4904-0-0x00007FFC66CC0000-0x00007FFC66F23000-memory.dmp
            Download

            memory/4904-1-0x00007FFC64E40000-0x00007FFC64F07000-memory.dmp
            Download

            memory/4904-3-0x00007FFC66CC0000-0x00007FFC66F23000-memory.dmp
            Download

            memory/4904-8-0x00007FFC66CC0000-0x00007FFC66F23000-memory.dmp
            Download

            memory/4904-6-0x00007FFC66CC1000-0x00007FFC66E2A000-memory.dmp
            Download

            memory/4904-4-0x00007FFC64E40000-0x00007FFC64F07000-memory.dmp
            Download