Overview

overview

10

Static

static

3

5e92ce4cef...cb.exe

windows7-x64

7

5e92ce4cef...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e92ce4cef6703976c149149ae4bcf4f47e1e9c1be7837293ae10f61a29944cb

  • Size

    1.4MB

  • Sample

    240702-f4q3sa1hnp

  • MD5

    01b3a61cc62086f1be20f992c618de56

  • SHA1

    2750b111d8705cc5d30796042a53423d451bea76

  • SHA256

    5e92ce4cef6703976c149149ae4bcf4f47e1e9c1be7837293ae10f61a29944cb

  • SHA512

    60e3770f2f1ed789b67e0922eca2fd984017b0424495b72d5d91d673c82e3bbd0e3c68c391e3147adc1d3d773139de3a2a9f0d5d29dd2bceb1247a6481b6c23b

  • SSDEEP

    24576:0Hyi0YRzZgx/jtTObFtURiRQkzRQD9ZkdxTu5iZpUHLQfRRNK:HIIhTObMbIItryK

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://49.233.48.44:443/Rpc

Attributes
  • user_agent

    Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)

Targets

    • Target

      5e92ce4cef6703976c149149ae4bcf4f47e1e9c1be7837293ae10f61a29944cb

    • Size

      1.4MB

    • MD5

      01b3a61cc62086f1be20f992c618de56

    • SHA1

      2750b111d8705cc5d30796042a53423d451bea76

    • SHA256

      5e92ce4cef6703976c149149ae4bcf4f47e1e9c1be7837293ae10f61a29944cb

    • SHA512

      60e3770f2f1ed789b67e0922eca2fd984017b0424495b72d5d91d673c82e3bbd0e3c68c391e3147adc1d3d773139de3a2a9f0d5d29dd2bceb1247a6481b6c23b

    • SSDEEP

      24576:0Hyi0YRzZgx/jtTObFtURiRQkzRQD9ZkdxTu5iZpUHLQfRRNK:HIIhTObMbIItryK

    Score
    10/10
    cobaltstrikebackdoortrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks