cobaltstrike | b48d3ae5fa7696774dfdad64078ca260f5121c03fca80fc53c0caf0bf346aeb1

General

Target

btc.exe
Size

161KB
MD5

0555493303b805edc68e153d013e6b30
SHA1

4c5a730e08120aac73369a893239268c56265d97
SHA256

b48d3ae5fa7696774dfdad64078ca260f5121c03fca80fc53c0caf0bf346aeb1
SHA512

4f7cdc3183e6868128d65ce1fb3062a638fd45108a263030654adaa6f2d3054753b4d8d6c40b12a76a988ae546f4604ea5e4e0f30312c6e7d49d9827eb98753e

Score

10^/10

cobaltstrike metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://www.impulse-static.com:443/site/content/jquery-3.3.1.slim.min.js

Extracted

Family

cobaltstrike

C2

http://www.impulse-static.com:443/site/jquery-3.3.1.min.js

http://www.shark-knifes.com:443/site/jquery-3.3.1.min.js

Attributes

access_type
512
beacon_type
2048
create_remote_thread
0
day
0
dns_idle
3.7054228e+09
dns_sleep
0
host
www.impulse-static.com,/site/jquery-3.3.1.min.js,www.shark-knifes.com,/site/jquery-3.3.1.min.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuZ2l0aHViLmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuZ2l0aHViLmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
injection_process
jitter
5888
maxdns
255
month
0
pipe_name
polling_time
10000
port_number
443
proxy_password
proxy_server
proxy_username
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIWFGzNKTst4Ksfub0bQSX5/CUWz/iN8e3Xl47TQNwtX9sqe1eYQ+J+W3Oc5ed0KqxL43LuWKHIn3o9ilVAqQ7zJFDyNWIwqjccImGdt8B7ktOmxuvzmxJvBN3Eg4PhcJQP82MsxB+F5QJuJ8rAxfzwhhewLHOf5vm9fnXH05ERwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4.234810624e+09
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown3
0
unknown4
0
unknown5
1
uri
/site/jquery-3.3.2.min.js
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
year
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of SetThreadContext 1 IoCs

Processes:

btc.exe

description pid process target process

PID 740 set thread context of 1712 740 btc.exe btc.exe

description	pid	process	target process
PID 740 set thread context of 1712	740	btc.exe	btc.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

btc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	btc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	btc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

btc.exe

description	pid	process	target process
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe
PID 740 wrote to memory of 1712	740	btc.exe	btc.exe

C:\Users\Admin\AppData\Local\Temp\btc.exe
"C:\Users\Admin\AppData\Local\Temp\btc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\btc.exe
"C:\Users\Admin\AppData\Local\Temp\btc.exe"
2⤵
- Modifies system certificate store
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-8-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmp

Filesize
2.5MB

Download
memory/740-2-0x000000000054D000-0x000000000054E000-memory.dmp

Filesize
4KB

Download
memory/740-3-0x0000000001D50000-0x0000000001D61000-memory.dmp

Filesize
68KB

Download
memory/1712-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1712-5-0x00000000004014B0-mapping.dmp

Download
memory/1712-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1712-7-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1712-9-0x0000000004050000-0x00000000044C2000-memory.dmp

Filesize
4.4MB

Download
memory/1712-10-0x0000000004050000-0x00000000044C2000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads