cobaltstrike | 57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b

General

Target

57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe
Size

145KB
MD5

e2b6f03cec1a309a7ba1d4ab8ac69807
SHA1

b41f768a2ec84e271b7a47edcb3465bf7ddb43e3
SHA256

57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b
SHA512

64231a60fff4c7fa8e913347c4c13561569ecc37b26a08edbac7cf879f9c7924e11926161acfc9cffc5135052ec528181f176312d302bc48a7092730d3403e5c
SSDEEP

1536:4X2tAh15hxrmf7VlBSBzD7TbNau3doRzEg0H86Lx8CAcf+SuqGMLefNe6WE5RXQ8:uv5hm7VmBP7PtReQJUhMLgEE5RXT

Score

10^/10

cobaltstrike backdoor persistence trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Executes dropped EXE 1 IoCs

Processes:

CacheMgr.exe

pid process

2008 CacheMgr.exe
Loads dropped DLL 1 IoCs

Processes:

57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe

pid process

1160 57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe

pid	process
2008	CacheMgr.exe

pid	process
1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as"	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe

description	pid	process	target process
PID 1160 wrote to memory of 1860	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	cmd.exe
PID 1160 wrote to memory of 1860	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	cmd.exe
PID 1160 wrote to memory of 1860	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	cmd.exe
PID 1160 wrote to memory of 1860	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	cmd.exe
PID 1160 wrote to memory of 2008	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	CacheMgr.exe
PID 1160 wrote to memory of 2008	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	CacheMgr.exe
PID 1160 wrote to memory of 2008	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	CacheMgr.exe
PID 1160 wrote to memory of 2008	1160	57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe	CacheMgr.exe

C:\Users\Admin\AppData\Local\Temp\57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe
"C:\Users\Admin\AppData\Local\Temp\57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b.exe" "C:\ProgramData\CacheMgr.exe"
2⤵
PID:1860

C:\ProgramData\CacheMgr.exe
"C:\ProgramData\CacheMgr.exe" -as
2⤵
- Executes dropped EXE
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CacheMgr.exe
Filesize
145KB

MD5
e2b6f03cec1a309a7ba1d4ab8ac69807

SHA1
b41f768a2ec84e271b7a47edcb3465bf7ddb43e3

SHA256
57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b

SHA512
64231a60fff4c7fa8e913347c4c13561569ecc37b26a08edbac7cf879f9c7924e11926161acfc9cffc5135052ec528181f176312d302bc48a7092730d3403e5c

Download Submit
C:\ProgramData\CacheMgr.exe
Filesize
145KB

MD5
e2b6f03cec1a309a7ba1d4ab8ac69807

SHA1
b41f768a2ec84e271b7a47edcb3465bf7ddb43e3

SHA256
57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b

SHA512
64231a60fff4c7fa8e913347c4c13561569ecc37b26a08edbac7cf879f9c7924e11926161acfc9cffc5135052ec528181f176312d302bc48a7092730d3403e5c

Download Submit
\ProgramData\CacheMgr.exe
Filesize
145KB

MD5
e2b6f03cec1a309a7ba1d4ab8ac69807

SHA1
b41f768a2ec84e271b7a47edcb3465bf7ddb43e3

SHA256
57bf03da98cd684005b177a6dd38ef7b21b70136da2ce0e3fdd79e95f59bd78b

SHA512
64231a60fff4c7fa8e913347c4c13561569ecc37b26a08edbac7cf879f9c7924e11926161acfc9cffc5135052ec528181f176312d302bc48a7092730d3403e5c

Download Submit
memory/1160-66-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/1160-59-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/1160-58-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1160-54-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1160-64-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1160-56-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1860-57-0x0000000000000000-mapping.dmp

Download
memory/2008-62-0x0000000000000000-mapping.dmp

Download
memory/2008-68-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2008-70-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2008-69-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/2008-71-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2008-72-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing