cobaltstrike | 4e9580ffb8bab8f70e2a1a6dfd5e29b279ae3ed0eb828aa11cf58d12f0dc6cdd

General

Target

4e9580ffb8bab8f70e2a1a6dfd5e29b279ae3ed0eb828aa11cf58d12f0dc6cdd.ps1
Size

6KB
MD5

c32ebbb82ca3f2587dc411aa2c17c8cd
SHA1

2b3a67f341f09bc736f0257b8e34a2f350a817bc
SHA256

4e9580ffb8bab8f70e2a1a6dfd5e29b279ae3ed0eb828aa11cf58d12f0dc6cdd
SHA512

84c99f25682cce38fdb14f2d2f126768d387758e766f3731d5146812afa7b8ac0f602ab1db75b7096964cbae8895ccd8f3cef7f802df803d2d273eedbaf459e3

Score

10^/10

cobaltstrike 426352781 backdoor suricata trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://208.87.206.140:1443/TVZY

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://208.87.206.140:1443/IE9CompatViewList.xml

Attributes

access_type
512
beacon_type
2048
host
208.87.206.140,/IE9CompatViewList.xml
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
1443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCRBsKRFE/mNvtYDYKs30r+2hJYGhV87My0blRS9rU9SOcXg6EaLjgrVv208ZNEeFKuARdAV7SpsrlidYeqPDKbTwpzK1NRjkz6uDh50eAR1xqR/uCQZr6MVUNuLHCHMtnt84d4D7trq1zVEFHz2SphTjFZC/VjGQeqyoKc2uSyZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)
watermark
426352781

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
4	1628	powershell.exe
6	1628	powershell.exe
7	1628	powershell.exe
8	1628	powershell.exe
10	1628	powershell.exe
11	1628	powershell.exe
13	1628	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1628 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1628 powershell.exe

pid	process
1628	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1628	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\4e9580ffb8bab8f70e2a1a6dfd5e29b279ae3ed0eb828aa11cf58d12f0dc6cdd.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Filesize
8KB

Download
memory/1628-57-0x0000000002940000-0x0000000002942000-memory.dmp

Filesize
8KB

Download
memory/1628-58-0x0000000002942000-0x0000000002944000-memory.dmp

Filesize
8KB

Download
memory/1628-59-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/1628-56-0x000007FEF2A10000-0x000007FEF356D000-memory.dmp

Filesize
11.4MB

Download
memory/1628-60-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/1628-61-0x000000000294B000-0x000000000296A000-memory.dmp

Filesize
124KB

Download
memory/1628-62-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/1628-63-0x000000001D030000-0x000000001D430000-memory.dmp

Filesize
4.0MB

Download
memory/1628-64-0x000000001BC10000-0x000000001BC5E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads