Cobalt Strikes Again: An Analysis of Obfuscated Malware
Tags
cmtmf-attack-pattern: Process Injection
attack-pattern: Data Hidden Window - T1564.003 Inter-Process Communication - T1559 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Process Injection - T1631 Python - T1059.006 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Hidden Window - T1143 Powershell - T1086 Process Injection - T1055
Show in Graph
Common Information
Type Value
UUID de51e459-3b9b-4d6d-a22d-6d0bb14ae076
Fingerprint b64b99a32dbb06da
Analysis status DONE
Considered CTI value 0
Text language
Published May 25, 2021, midnight
Added to db Sept. 26, 2022, 9:30 a.m.
Last updated Nov. 18, 2024, 2:36 a.m.
Headline Cobalt Strikes Again: An Analysis of Obfuscated Malware
Title Cobalt Strikes Again: An Analysis of Obfuscated Malware
Detected Hints/Tags/Attributes 63/2/4
Source URLs
Redirection Url
Details Source https://www.huntress.com/blog/cobalt-strike-analysis-of-obfuscated-malware
URL Provider
Details Provider Source level domain
Details huntress.com www.huntress.com
Attributes
Details Type #Events CTI Value
Details File 82 
werfault.exe
Details File 146 
wininet.dll
Details File 130 
ws2_32.dll
Details Windows Registry Key 15 
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce