cobaltstrike | a5a4d88e2fe16d319aef6f7550ca2379d253a943d467dedc21e7ea3deb19410e

General

Target
1089b93a4a286283523deac740716ebd.exe
Size 2.6MB
Sample210628-emekqgrdls
SHA256 a5a4d88e2fe16d319aef6f7550ca2379d253a943d467dedc21e7ea3deb19410e
MD5 1089b93a4a286283523deac740716ebd
SHA1 0638b4b285c85709b83148ceeec44948644d6eac
SHA512 a78c5fbc0bc60da60d199385fe438b733ef7b1701d9c458c772803c284f4a32a23fed54d0fbca77bb08557cf23a16a728ddd71705d313347ca595510b450e9dd
MD5 SHA1 SHA512

Score

10^/10

cobaltstrike 1 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1

C2

http://wuyoo.vip:2083/fwlink
http://www.wuyoo.vip:2083/ga.js

Attributes

access_type
512
beacon_type
2048
host
wuyoo.vip,/fwlink,www.wuyoo.vip,/ga.js
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
2083
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDzJA4sj/0a/fQnMKaZgEA1YSqbZFwyMLSSr01ydJyxt7ljyZv/l7jTkxMMvve+itw08tB+nyVoICNvSQPtQ5efrTh16zxsEj/yF3fQQDTFBrlvL17Yb9CUlvCaEMLliCl+qh/6Ug6mYSHoZ1LsLDgcFsE/EZFoN2k7fKxciuEQKwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322)
watermark
1

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 2 IoCs

pid	Process
1832	flashplayerax_install_cn.exe
2568	Windows_Defender_SmartScre.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3384	1832	WerFault.exe	74

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3384	WerFault.exe
Token: SeBackupPrivilege	3384	WerFault.exe
Token: SeDebugPrivilege	3384	WerFault.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1832	flashplayerax_install_cn.exe
1832	flashplayerax_install_cn.exe
1832	flashplayerax_install_cn.exe
1832	flashplayerax_install_cn.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 1832	3152	1089b93a4a286283523deac740716ebd.exe	74
PID 3152 wrote to memory of 1832	3152	1089b93a4a286283523deac740716ebd.exe	74
PID 3152 wrote to memory of 1832	3152	1089b93a4a286283523deac740716ebd.exe	74
PID 3152 wrote to memory of 2568	3152	1089b93a4a286283523deac740716ebd.exe	77
PID 3152 wrote to memory of 2568	3152	1089b93a4a286283523deac740716ebd.exe	77

C:\Users\Admin\AppData\Local\Temp\1089b93a4a286283523deac740716ebd.exe
"C:\Users\Admin\AppData\Local\Temp\1089b93a4a286283523deac740716ebd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\windows\temp\flashplayerax_install_cn.exe
  "C:\windows\temp\flashplayerax_install_cn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 2024
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\windows\temp\Windows_Defender_SmartScre.exe
  "C:\windows\temp\Windows_Defender_SmartScre.exe"
  2⤵
  - Executes dropped EXE
  PID:2568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-121-0x0000000000D60000-0x0000000000E0E000-memory.dmp

Download

memory/2568-123-0x0000000000140000-0x0000000000180000-memory.dmp

Download

memory/2568-124-0x0000000000190000-0x00000000001DD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads