cobaltstrike | ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500

Sharing

Copy URL Twitter E-mail

General

Target
ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500
Size 1.0MB
Sample261106-e42zlsag75
SHA256 ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500
MD5 289b2dddc8d65e922a9c3a7ce79e1d1a
SHA1 bc4b0297db46e2bb869cc8ec6914629da272468b
SHA512 a63231881a1c7cca6e81bff06f143e8b4b2858d75a4d4921d5c6c06efaa9a6f4c982439a8fc88b4140e4cdbefb33395b4b01b07e7fccf04500919619b589be80
SSDEEP 24576:/zXtagYRsShJz6kdD6jiJ3M/A0NbH/vpGWIZwn:ryRlhJWkdWjiJghNb/
TLSH
T115259DA1E7A01594E07BC27DC7724977EAF1FC1013242ADB8660FB957A32BE064397D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://��H�� H��AYAYPPPPM1�AQH��:281314120H��A��]��H�� H�� XXXXH��A�Ɩ�R�ջ�* A��H��(<| ��u�Groj
http://A�s��l��H�� H��:2202588671A��H��(<| ��u�Groj

Attributes

user_agent
.dll

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500

File Explorer

ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500

.sys 1.0MB

ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500

IMPHASH 58b4d3ddd76a40c21f8e416f5884461d
SHA256 ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500
MD5 289b2dddc8d65e922a9c3a7ce79e1d1a
SHA1 bc4b0297db46e2bb869cc8ec6914629da272468b
SHA512 a63231881a1c7cca6e81bff06f143e8b4b2858d75a4d4921d5c6c06efaa9a6f4c982439a8fc88b4140e4cdbefb33395b4b01b07e7fccf04500919619b589be80
SSDEEP 24576:/zXtagYRsShJz6kdD6jiJ3M/A0NbH/vpGWIZwn:ryRlhJWkdWjiJghNb/
TLSH
T115259DA1E7A01594E07BC27DC7724977EAF1FC1013242ADB8660FB957A32BE064397D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1151076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vdiskbus64.pdb

ntoskrnl.exe

ZwDeviceIoControlFile ZwOpenSection ZwEnumerateKey ZwOpenKey DbgPrint MmUnmapLockedPages _stricmp _wcsicmp sprintf ZwCreateEvent IoBuildDeviceIoControlRequest KeResetEvent ZwSetSystemInformation RtlAnsiStringToUnicodeString PsSetLoadImageNotifyRoutine PsLookupProcessByProcessId ZwQuerySymbolicLinkObject _wcsnicmp ZwReadFile RtlDowncaseUnicodeString wcsncpy strchr MmGetSystemRoutineAddress RtlInitAnsiString ZwPowerInformation RtlUnicodeStringToAnsiString ZwSetValueKey ZwQuerySystemInformation RtlInitString PsSetCreateProcessNotifyRoutine RtlEqualUnicodeString ZwOpenSymbolicLinkObject IoFreeMdl FsRtlIsNameInExpression ZwUnloadDriver KeDelayExecutionThread RtlFreeUnicodeString wcsstr MmMapLockedPagesSpecifyCache IoGetDeviceObjectPointer IoRegisterBootDriverReinitialization KeQueryTimeIncrement PsGetProcessSessionId ObReferenceObjectByHandle PsRemoveLoadImageNotifyRoutine RtlFreeAnsiString RtlWriteRegistryValue MmProbeAndLockPages swscanf_s RtlCompareUnicodeString CmRegisterCallback MmUnlockPages RtlCopyUnicodeString ObfDereferenceObject wcscat_s ZwOpenFile RtlCompareMemory ZwQueryInformationFile strcat_s ExSetTimerResolution IoGetDeviceProperty RtlDeleteRegistryValue strncpy_s IoAllocateMdl IofCallDriver ZwQueryKey NtNotifyChangeDirectoryFile ZwFsControlFile ZwWaitForSingleObject ZwQueryVolumeInformationFile ZwDuplicateObject NtShutdownSystem ZwAdjustPrivilegesToken ZwOpenProcessTokenEx ExUuidCreate ZwDeleteValueKey KeReleaseSpinLock KeAcquireSpinLockRaiseToDpc KeQueryActiveProcessors KdDebuggerNotPresent IoRegisterPlugPlayNotification ExSystemTimeToLocalTime KdDebuggerEnabled Mm64BitPhysicalAddress IoGetCurrentProcess IoCreateSymbolicLink RtlTimeToTimeFields PsGetVersion KeNumberProcessors InitSafeBootMode sprintf_s vsprintf_s strcpy_s ZwDeleteKey ExQueueWorkItem KeInitializeDpc KeInitializeTimer _vsnprintf KeSetTimer KeCancelTimer _strupr CmCallbackGetKeyObjectID RtlGetVersion ZwSetInformationFile ZwDeleteFile ZwWriteFile KeBugCheckEx ZwQueryInformationProcess ZwOpenProcess KeWaitForSingleObject RtlRandom ZwUnmapViewOfSection ZwQueryValueKey ZwCreateFile KeInitializeEvent swprintf ZwMapViewOfSection KeSetPriorityThread ZwCreateKey PsGetProcessId DbgPrintEx MmIsAddressValid PsGetCurrentProcessId CmUnRegisterCallback PsGetCurrentThreadId IoFreeIrp IoAllocateIrp MmAllocatePagesForMdl MmUnmapIoSpace KeSetTimerEx MmMapIoSpace MmFreePagesFromMdl IoInvalidateDeviceRelations MmBuildMdlForNonPagedPool PoSetPowerState IoCsqInitialize ExInterlockedInsertTailList ExInterlockedRemoveHeadList ExInterlockedAddLargeInteger IoGetRelatedDeviceObject RtlPrefixUnicodeString ZwEnumerateValueKey ObQueryNameString RtlCheckRegistryKey RtlCreateRegistryKey CmRegisterCallbackEx RtlImageDirectoryEntryToData RtlImageNtHeader RtlUpcaseUnicodeChar KeRegisterBugCheckReasonCallback RtlAnsiCharToUnicodeChar ExFreePool IoCancelIrp IoReuseIrp MmIsNonPagedSystemAddressValid __C_specific_handler ObReferenceObjectByName IoDriverObjectType IoWMIQueryAllData IoWMIOpenBlock IoWMISetSingleInstance ZwInitiatePowerAction ExReleaseFastMutex ExAcquireFastMutex KeClearEvent KeSetTargetProcessorDpc KeQueryActiveProcessorCount KeIpiGenericCall KeInsertQueueDpc KeQueryUnbiasedInterruptTime ZwClose PsTerminateSystemThread IoUnregisterShutdownNotification PsCreateSystemThread PsGetThreadId KeSetEvent RtlInitUnicodeString IoRegisterShutdownNotification IoDeleteSymbolicLink ExAllocatePoolWithTag IoThreadToProcess ExAllocatePoolWithTagPriority IoCreateDevice ObfReferenceObject PoCallDriver IoAttachDeviceToDeviceStack IoGetAttachedDeviceReference IofCompleteRequest PoStartNextPowerIrp IoDetachDevice IoDeleteDevice RtlAppendUnicodeStringToString ExFreePoolWithTag __chkstk

hal

HalReturnToFirmware KeStallExecutionProcessor KeQueryPerformanceCounter

netio.sys

NotifyIpInterfaceChange NotifyUnicastIpAddressChange WskReleaseProviderNPI WskDeregister WskCaptureProviderNPI WskRegister GetUnicastIpAddressTable NotifyRouteChange2 CancelMibChangeNotify2 ConvertInterfaceLuidToGuid GetUnicastIpAddressEntry FreeMibTable

tdi.sys

TdiDeregisterPnPHandlers TdiRegisterPnPHandlers

fltmgr.sys

FltReleaseFileNameInformation FltGetFileNameInformationUnsafe

Name

.text

Size

627KB

Virtual Size

626KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

354KB

Virtual Size

449KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ad550b8fd3ee11acfee5c0ab626486591876ec31763cfbe608a0c1c679627500

ntoskrnl.exe

hal

netio.sys

tdi.sys

fltmgr.sys

generic