cobaltstrike | 45b9925b65bd1e2e14d5799ee08b7d8d0102e655312a5d7adf28af352f2aeb82

General

Target
45b9925b65bd1e2e14d5799ee08b7d8d0102e655312a5d7adf28af352f2aeb82
Size 336KB
Sample261030-kc3dysxvcs
SHA256 45b9925b65bd1e2e14d5799ee08b7d8d0102e655312a5d7adf28af352f2aeb82
MD5 4d0d2d58e95ababcc9e24e7f066e7c5e
SHA1 d671943e0219a9f0d207ee530d28aecbdc40c3b5
SHA512 5e83edcdffa24ab27323ac776e60cbf2253b75cbde25dd642212b1350c26bce0264d444baac305d2a2fdb4e1e17f70e4b32fde7a5708b8ec84541da6fd613e18
SSDEEP 6144:zhOmbxQ5//EPcGTNzbe4fjT3C7oxhF/mvN71p3gxgWEZZpy0TNbfN+:zUmi4cuNG4rT3Vxhd+N71p3VpZZpygbY
TLSH
T15B7423AEB48F531DAD8B2833D6BF82188B1C44F53197A1D679386C818676581BF407FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://dl29l5q6o3b1e.cloudfront.net:443/ajax/libs/jquery/3.7.1/jquery.min.js

Attributes

access_type
512
beacon_type
2048
host
dl29l5q6o3b1e.cloudfront.net
http_header1
AAAACgAAAF5BY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGFwcGxpY2F0aW9uL2pzb247cT0wLjgsKi8qO3E9MC43AAAAEAAAACNIb3N0OiBkMno1NHB2aWgzYW5wYS5jbG91ZGZyb250Lm5ldAAAAAoAAAAmUmVmZXJlcjogaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS8AAAAKAAAAIkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZSwgYnIAAAAKAAAAJU9yaWdpbjogaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS8AAAAKAAAAIFgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0AAAABwAAAAAAAAANAAAAAgAAAAdjZi1yYXk9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAF5BY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGFwcGxpY2F0aW9uL2pzb247cT0wLjgsKi8qO3E9MC43AAAAEAAAACNIb3N0OiBkMno1NHB2aWgzYW5wYS5jbG91ZGZyb250Lm5ldAAAAAoAAAAmUmVmZXJlcjogaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS8AAAAKAAAAIkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZSwgYnIAAAAKAAAAJU9yaWdpbjogaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS8AAAAKAAAAIFgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0AAAABwAAAAAAAAAPAAAADQAAAAUAAAAHc2Vzc2lvbgAAAAcAAAABAAAADwAAAA0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
7680
month
3.3554432e+07
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\wermgr.exe
sc_process64
%windir%\sysnative\wermgr.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLigXafe7y3pRM2Y6Y2BTz+U1DrJr5bB5SETrO/pdmWA8OMg+/+8ACjyRU1JYcvLU8z70fa7ahy3kyX4M1PdSrTlFYT8CdIszo/8VcnhMqVwfFVHkqHwqZIVJ/X/AG6qn60v7cyz5ZZXj99+iIg0aV/5V0xXVwszpmJtg/xVs5owIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.37154816e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/ajax/libs/jquery/3.7.1/jquery.slim.js
user_agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3
watermark
987654321

Targets

- Target
  1/PrintPoolService.exe
- Size 81KB
- SHA256 e768ff1f2f31178fe5930f261acd4b19464acc019fb0aa697d0b48686e59050c
- MD5 a91f621a8a0de91fae53d3051303809b
- SHA1 2541f0f3b27dea36e41b2869fa219580052a8a65
- SHA512 620fb551528ad6af4ac627b84416e7e921d97fe663a8b663f3ec0030cca14a7b663bfb5db5bf3d21e0f427d6159ce7b44a5114b4596a1032632ccbf80a57e26e
- SSDEEP 768:ZZQ8fNpHc4xMQd8HIryIc3YaB3CE45nHQSRRbSK7SSw1PWZ:/3N3MQ6omIcoKCE45nHQ8APWZ
- TLSH
  T12883D7C2AE98BE05E5BA19303A75C97D2927BE514F14D5CF2853F74D0878FC89E38912
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor 987654321 discovery cobaltstrike trojan
- Family: Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
behavioral1
- Target
  1/SettingsCoreUci.dll
- Size 302KB
- SHA256 843771ea7c3bb0fce2cf67200f80020edc8d8e1531c3287a01ab5330c8144a00
- MD5 ace839222689228a620722b96fa95008
- SHA1 62634bebf7cd28df3f88a24ddcb84db081f790cd
- SHA512 65f92cc7f02e65e154a7964f4b54750949e0af67655ebda86c005b4317c79007127cea8e7f727d83a1dc880a97bcc8b781db8927e0fa2553e7b8967ff92bfe33
- SSDEEP 6144:/bxQr//EPcGTNzb84fzT3M7o9hblmvh71p5gdgWg3Hpy0RNQfH:/iQcuNU4LT3r9hZ+h71p59P3HpycQf
- TLSH
  T1D46423EDA48F631D7E8B2837D6BF8158170D80F1656BA1D4B978ACC186664907F803FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  1/systemsettings.dll
- Size 22KB
- SHA256 2e8576c981b74eaabe7e74053c945228c5d6687463d56f72cdf940113a1f8eed
- MD5 b96e6d0f165b580216fc4fdac35d067f
- SHA1 6a3d50cb81969f52586da2bfb20c165afbf484d8
- SHA512 5efea4dbd11ae6729b96f965f71179642f9409bdb7be5f652a842fc7b864e1f6dd941da44866228194e4fae285e0abad5d2c5e9b141369b5a6880946e0b1feb8
- SSDEEP 384:xvK4iWzPfatF6MJhwoOD9DMF81tAnKIQlnSmbZa1mZg55pXRkH5dSXb1FLkQP:xvKWk6L7D9DMK1t5VlnSmbQKbZdSXBFp
- TLSH
  T1C4A2A468E75335AECDBBC670C737B03074A03D262B609CFF9284A6256DA4AC45234F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Cobaltstrike

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5