cobaltstrike | 4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f

Sharing

Copy URL Twitter E-mail

General

Target
4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f
Size 1.0MB
Sample261106-e5dneatv5k
SHA256 4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f
MD5 d466e9214c9bb1fc41b788c3581863a7
SHA1 57ecdcaac4099d943b41288ccc6c4619dde00481
SHA512 5ca0cb7050375531c92bdebecd6805979917ec00ef666c4586636c7196fe5f9ea40b63701582ea91c1f9b7b645c6a126fb5652af73d4976b84d59a1826179bbb
SSDEEP 24576:BK6IrFHrw9dfQZxKiYy8ibH/vpGWIZRq:sDFHrmdfQnePib/
TLSH
T1CF359DA1E7A01994E07BC17DC7724977EAF2FC1413102ADB8660FB957A32BE064397D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://��H�� H��AYAYPPPPM1�AQH��:281314120H��A��]��H�� H�� XXXXH��A�Ɩ�R�ջ�* A��H��(<| ��u�Groj
http://A�s��l��H�� H��:2202588671A��H��(<| ��u�Groj

Attributes

user_agent
.dll

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f

File Explorer

4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f

.sys 1.0MB

4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f

IMPHASH e6ebc7cfee13c837d6bc651c9cf6a3b8
SHA256 4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f
MD5 d466e9214c9bb1fc41b788c3581863a7
SHA1 57ecdcaac4099d943b41288ccc6c4619dde00481
SHA512 5ca0cb7050375531c92bdebecd6805979917ec00ef666c4586636c7196fe5f9ea40b63701582ea91c1f9b7b645c6a126fb5652af73d4976b84d59a1826179bbb
SSDEEP 24576:BK6IrFHrw9dfQZxKiYy8ibH/vpGWIZRq:sDFHrmdfQnePib/
TLSH
T1CF359DA1E7A01994E07BC17DC7724977EAF2FC1413102ADB8660FB957A32BE064397D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1167460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vdiskbus64.pdb

ntoskrnl.exe

ZwEnumerateKey ZwOpenKey DbgPrint MmUnmapLockedPages _stricmp _wcsicmp sprintf ZwCreateEvent IoBuildDeviceIoControlRequest KeResetEvent ZwSetSystemInformation RtlAnsiStringToUnicodeString PsSetLoadImageNotifyRoutine PsLookupProcessByProcessId ZwQuerySymbolicLinkObject _wcsnicmp ZwReadFile RtlDowncaseUnicodeString wcsncpy strchr MmGetSystemRoutineAddress RtlInitAnsiString ZwPowerInformation RtlUnicodeStringToAnsiString ZwSetValueKey ZwQuerySystemInformation RtlInitString PsSetCreateProcessNotifyRoutine RtlEqualUnicodeString ZwOpenSymbolicLinkObject IoFreeMdl FsRtlIsNameInExpression ZwUnloadDriver KeDelayExecutionThread RtlFreeUnicodeString wcsstr MmMapLockedPagesSpecifyCache IoGetDeviceObjectPointer IoRegisterBootDriverReinitialization KeQueryTimeIncrement PsGetProcessSessionId ObReferenceObjectByHandle PsRemoveLoadImageNotifyRoutine RtlFreeAnsiString RtlWriteRegistryValue MmProbeAndLockPages swscanf_s RtlCompareUnicodeString CmRegisterCallback MmUnlockPages RtlCopyUnicodeString ObfDereferenceObject wcscat_s ZwOpenFile CmUnRegisterCallback ZwOpenSection strcat_s ExSetTimerResolution IoGetDeviceProperty RtlDeleteRegistryValue strncpy_s IoAllocateMdl IofCallDriver ZwQueryKey NtNotifyChangeDirectoryFile ZwFsControlFile ZwWaitForSingleObject ZwQueryVolumeInformationFile ZwDuplicateObject NtShutdownSystem ZwAdjustPrivilegesToken ZwOpenProcessTokenEx ExUuidCreate ZwDeleteValueKey KeReleaseSpinLock KeAcquireSpinLockRaiseToDpc KeQueryActiveProcessors KdDebuggerNotPresent IoRegisterPlugPlayNotification ExSystemTimeToLocalTime KdDebuggerEnabled Mm64BitPhysicalAddress IoGetCurrentProcess RtlAppendUnicodeStringToString RtlTimeToTimeFields PsGetCurrentProcessId KeNumberProcessors InitSafeBootMode sprintf_s vsprintf_s strcpy_s ZwDeleteKey ExQueueWorkItem KeInitializeDpc KeInitializeTimer _vsnprintf KeSetTimer KeCancelTimer _strupr CmCallbackGetKeyObjectID RtlGetVersion ZwSetInformationFile ZwDeleteFile ZwWriteFile KeBugCheckEx PsGetCurrentThreadId IoCreateSymbolicLink ZwDeviceIoControlFile RtlCompareMemory KeWaitForSingleObject RtlRandom ZwUnmapViewOfSection ZwQueryValueKey ZwCreateFile KeInitializeEvent swprintf ZwMapViewOfSection KeSetPriorityThread ZwCreateKey PsGetProcessId DbgPrintEx ZwQueryInformationFile MmIsAddressValid IoFreeIrp IoAllocateIrp MmAllocatePagesForMdl MmUnmapIoSpace KeSetTimerEx MmMapIoSpace MmFreePagesFromMdl IoInvalidateDeviceRelations MmBuildMdlForNonPagedPool PoSetPowerState IoCsqInitialize ExInterlockedInsertTailList ExInterlockedRemoveHeadList ExInterlockedAddLargeInteger IoGetRelatedDeviceObject RtlPrefixUnicodeString ZwEnumerateValueKey ObQueryNameString RtlCheckRegistryKey RtlCreateRegistryKey CmRegisterCallbackEx RtlImageDirectoryEntryToData RtlImageNtHeader RtlUpcaseUnicodeChar KeRegisterBugCheckReasonCallback RtlAnsiCharToUnicodeChar ExFreePool IoCancelIrp IoReuseIrp MmIsNonPagedSystemAddressValid __C_specific_handler ObReferenceObjectByName IoDriverObjectType IoWMIQueryAllData IoWMIOpenBlock IoWMISetSingleInstance ZwInitiatePowerAction ExReleaseFastMutex ExAcquireFastMutex KeClearEvent KeSetTargetProcessorDpc KeQueryActiveProcessorCount KeIpiGenericCall KeInsertQueueDpc KeQueryUnbiasedInterruptTime MmGetPhysicalAddress IoGetDmaAdapter ZwQueryInformationProcess ZwOpenProcess ZwClose PsTerminateSystemThread IoUnregisterShutdownNotification PsCreateSystemThread PsGetThreadId KeSetEvent RtlInitUnicodeString IoRegisterShutdownNotification IoDeleteSymbolicLink ExAllocatePoolWithTag IoThreadToProcess ExAllocatePoolWithTagPriority IoCreateDevice ObfReferenceObject PoCallDriver IoAttachDeviceToDeviceStack IoGetAttachedDeviceReference IofCompleteRequest PoStartNextPowerIrp IoDetachDevice IoDeleteDevice PsGetVersion ExFreePoolWithTag __chkstk

hal

HalSetBusDataByOffset HalGetBusDataByOffset HalReturnToFirmware KeStallExecutionProcessor KeQueryPerformanceCounter

netio.sys

NotifyIpInterfaceChange NotifyUnicastIpAddressChange WskReleaseProviderNPI WskDeregister WskCaptureProviderNPI WskRegister GetUnicastIpAddressTable NotifyRouteChange2 CancelMibChangeNotify2 ConvertInterfaceLuidToGuid GetUnicastIpAddressEntry FreeMibTable

tdi.sys

TdiDeregisterPnPHandlers TdiRegisterPnPHandlers

fltmgr.sys

FltReleaseFileNameInformation FltGetFileNameInformationUnsafe

Name

.text

Size

637KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

354KB

Virtual Size

453KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4bd6fb80968d2bf348e83cebe75c02543917b85cd539d0b3fdba90174023251f

ntoskrnl.exe

hal

netio.sys

tdi.sys

fltmgr.sys

generic