cobaltstrike | hxxp://185[.]74[.]222[.]145[:]64 | Triage

Submit
Reports

Overview

overview

Static

static

1

URLScan

urlscan

1

http://185.74.222.14...

windows7-x64

http://185.74.222.14...

windows10-2004-x64

Resubmissions

16-12-2023 06:43

231216-hhfe9scbh4 10

16-12-2023 05:16

231216-fyd62acae9 10

Sharing

General

Target

http://185.74.222.145:64
Sample

231216-fyd62acae9

Score

10^/10

cobaltstrike backdoor trojan

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://185.74.222.145:64

Resource

win7-20231129-en

cobaltstrike backdoor trojan

windows7-x64

12 signatures

300 seconds

Behavioral task

behavioral2

Sample

http://185.74.222.145:64

Resource

win10v2004-20231215-en

cobaltstrike backdoor trojan

windows10-2004-x64

14 signatures

300 seconds

Malware Config

Extracted

Family

cobaltstrike

C2

http://185.74.222.145:676/PPDy

http://185.74.222.145:676/y6Dj

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Targets

- Target
  
  http://185.74.222.145:64
Score

10^/10

cobaltstrike backdoor trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

urlscan1

behavioral1

cobaltstrikebackdoortrojan

behavioral2

cobaltstrikebackdoortrojan

© 2018-2024

Terms | Privacy