cobaltstrike | 620a87d359a1a5e22b983e28a8635a0856529991be777416fbc901b02d480c90

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 05:23

Target

14d18dcabdddbee8881ef43add7c618a_JaffaCakes118.dll
Size

2.0MB
MD5

14d18dcabdddbee8881ef43add7c618a
SHA1

e8e2adeced5a50fdf2a8e89c8f157c3062105ec9
SHA256

620a87d359a1a5e22b983e28a8635a0856529991be777416fbc901b02d480c90
SHA512

bf972b451d15c6374107f28633f7dba3caa9c37efdf44cefe9a285c1a24382b1424be5a78d1fde81c0cd72b937cf5516551614b1bd26a7cfc1de2fdbe314e572
SSDEEP

24576:z/59yhjXHuw4DUq6SIQEx+zL5rCWwHawFvDOpfYiCAm+NAW:z3yZgDQBQEx+zL5WWwHFFSSAm+NAW

Score

10^/10

Family

cobaltstrike

http://62.171.141.54:443/static-directory/default.ico

Attributes

user_agent
Connection: close Accept: image/jpeg Accept-Language: en-US User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow pid process

1 4964 rundll32.exe
2 4964 rundll32.exe
3 4964 rundll32.exe
10 4964 rundll32.exe
21 4964 rundll32.exe
25 4964 rundll32.exe
26 4964 rundll32.exe
27 4964 rundll32.exe
28 4964 rundll32.exe
33 4964 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d18dcabdddbee8881ef43add7c618a_JaffaCakes118.dll,#1
1⤵
- Blocklisted process makes network request
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:5068

memory/4964-0-0x00007FF8C0C80000-0x00007FF8C0D3E000-memory.dmp

Filesize
760KB

Download
memory/4964-3-0x000001AA77B40000-0x000001AA77B41000-memory.dmp

Filesize
4KB

Download
memory/4964-1-0x00007FF8BF230000-0x00007FF8BF4F9000-memory.dmp

Filesize
2.8MB

Download
memory/4964-2-0x00007FF8C1A10000-0x00007FF8C1C05000-memory.dmp

Filesize
2.0MB

Download
memory/4964-4-0x0000000063BC0000-0x0000000063E03000-memory.dmp

Filesize
2.3MB

Download