Cobalt Strike Beacon Malware Analysis
Tags
Common Information
| Type | Value |
|---|---|
| UUID | afb95e23-768f-4814-a0bc-4808b069f4e8 |
| Fingerprint | 800f9f1429070612 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Sept. 17, 2024, 8:40 p.m. |
| Added to db | Sept. 17, 2024, 10:56 p.m. |
| Last updated | Nov. 17, 2024, 6:55 p.m. |
| Headline | Cobalt Strike Beacon Malware Analysis |
| Title | Cobalt Strike Beacon Malware Analysis |
| Detected Hints/Tags/Attributes | 53/1/31 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 171 | ✔ | Malware on Medium | https://medium.com/feed/tag/malware | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 93 | bazaar.abuse.ch |
|
| Details | Domain | 53 | oledump.py |
|
| Details | Domain | 1 | t4.mz |
|
| Details | Domain | 1 | t3.mz |
|
| Details | File | 1 | cobalt.msi |
|
| Details | File | 49 | oledump.py |
|
| Details | File | 6 | i.exe |
|
| Details | File | 1 | stream2.exe |
|
| Details | File | 1 | stream4.exe |
|
| Details | File | 1 | stream6.exe |
|
| Details | File | 1 | stream7.exe |
|
| Details | File | 1 | c:\users\public\wmiprvse.bat |
|
| Details | File | 1 | wmiprvse.bat |
|
| Details | File | 1 | ndtcn1.dat |
|
| Details | File | 1 | c:\users\public\wmiprvse.exe |
|
| Details | File | 1 | c:\users\public\ndtcn1.dat |
|
| Details | File | 226 | certutil.exe |
|
| Details | File | 142 | wmiprvse.exe |
|
| Details | File | 14 | beacon.dll |
|
| Details | File | 1 | wmiprvse_dumped.bin |
|
| Details | File | 44 | submit.php |
|
| Details | File | 21 | %windir%\\syswow64\\rundll32.exe |
|
| Details | File | 21 | %windir%\\sysnative\\rundll32.exe |
|
| Details | sha256 | 1 | 29dd2916c20e18b713a8ecb72d3df632961e818cf35484ec6bafedc2ff415680 |
|
| Details | sha256 | 1 | 26b74954ed3e0e81b4f9304e3baa149866320a10f5f6468883c9fa6358a75a6c |
|
| Details | sha256 | 1 | 3071af6be43a2611db45205f0d3f1f25aba05acf5f70992fce2fffd63ee9c85d |
|
| Details | sha256 | 1 | 39fd8d36f8e5d915ad571ea429db3c3de6e9c160dbea7c3e137c9ba4b7fd301d |
|
| Details | sha256 | 1 | 745c182ee546d40e060348e3be4719b1c2b2156e0b30a2cab1cc035f5f33a132 |
|
| Details | IPv4 | 1 | 45.76.192.215 |
|
| Details | MITRE ATT&CK Techniques | 91 | T1620 |
|
| Details | Url | 1 | https://bazaar.abuse.ch/sample/29dd2916c20e18b713a8ecb72d3df632961e818cf35484ec6bafedc2ff415680 |