cobaltstrike | 5b8a8adb5c9aeea15b178e8800151d6d8536b2da52914602aab693b15a06be82

General

Target

34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe
Size

682KB
MD5

47ca254d94b8ba124ba8a3fdb4a52653
SHA1

910ffae9ce8b4f49f5527c9dab5fca9dddc8d60d
SHA256

34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e
SHA512

78d49a71ad663e4a45d282a40ff478d4872ff47e4efd5cef49ec2a893b6a7e86a1dabf43b27fa144471a741a22917c8d313f0b5a39e17dc1edeafc4af932466d
SSDEEP

12288:vRZ+IoG/n9IQxW3OBsevLYTHDbv5DgsI/kXZb8GngkN/n:n2G/nvxW3Wq6al8GZn

Score

10^/10

cobaltstrike 0 1234567890 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1234567890

C2

http://39.107.70.26:8888/g.pixel

Attributes

access_type
512
host
39.107.70.26,/g.pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
8888
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMklwKQewNEYW88qrK3pE0Q4C+CRg7fG8WYX/yMH1r+hqXvGhp5IJYnwMgXxKAuFFDGElr5GacyW2WySu7eubRX3hOcNqvI4SlMyYkHzFbcosRucdKZ7q01oZaxwhYGBlcP5Vv+Xm1MhSVyfOfzvJ7c6HIqqe6ZQFqOcTqrkxWmQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
watermark
1234567890

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 592 rundll32.exe
Executes dropped EXE 1 IoCs

Processes:

cacert.exe

pid process

1532 cacert.exe

flow	pid	process
3	592	rundll32.exe

pid	process
1532	cacert.exe

Loads dropped DLL 2 IoCs

Processes:

34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe

pid	process
1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe
1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe

description	pid	process	target process
PID 1720 wrote to memory of 1532	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	cacert.exe
PID 1720 wrote to memory of 1532	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	cacert.exe
PID 1720 wrote to memory of 1532	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	cacert.exe
PID 1720 wrote to memory of 1532	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	cacert.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe
PID 1720 wrote to memory of 592	1720	34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe
"C:\Users\Admin\AppData\Local\Temp\34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\Temp\cacert.exe
"C:\Windows\Temp\cacert.exe"
2⤵
- Executes dropped EXE
PID:1532

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Windows\Temp\cacert.der
2⤵
- Blocklisted process makes network request
PID:592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\cacert.der
Filesize
940B

MD5
7858988dc3df116e2bde2787ebd6e10d

SHA1
cdff5fd51c1e8fcf8f91ad3a6ab8dfefc3956a2b

SHA256
cd905bb5f6773d44d457f4d80af02f53c04719874b3ccf52a4875b729bd43b6d

SHA512
e390e47dc6d566e667f26f1a8e3ddac29443a2d10a813a18f8e0a77872015a9aadaed2a9d54f4fdf8ab01efd6726ff1bb03d66d5d965112a60316cee26339e58

Download Submit
C:\Windows\Temp\cacert.exe
Filesize
281KB

MD5
ab8ae66d02d1e0d8bcde85eb9eb9d10a

SHA1
5cc769447e0ec91b36fb2f9cde1e39de30baa8c8

SHA256
7626db12c55677596bbeaaf6f93ecead45f0a972914d7ab94e81be6355467c28

SHA512
a334833437f90028f9b812ed2634b2e6239e37acfdaad21c7904eace4e9bf5b17c3f8e1293c25f002486cd1fb3ab55a8dd720cc778c34b9daeffd292ad3e1377

Download Submit
C:\Windows\Temp\cacert.exe
Filesize
281KB

MD5
ab8ae66d02d1e0d8bcde85eb9eb9d10a

SHA1
5cc769447e0ec91b36fb2f9cde1e39de30baa8c8

SHA256
7626db12c55677596bbeaaf6f93ecead45f0a972914d7ab94e81be6355467c28

SHA512
a334833437f90028f9b812ed2634b2e6239e37acfdaad21c7904eace4e9bf5b17c3f8e1293c25f002486cd1fb3ab55a8dd720cc778c34b9daeffd292ad3e1377

Download Submit
\Windows\Temp\cacert.exe
Filesize
281KB

MD5
ab8ae66d02d1e0d8bcde85eb9eb9d10a

SHA1
5cc769447e0ec91b36fb2f9cde1e39de30baa8c8

SHA256
7626db12c55677596bbeaaf6f93ecead45f0a972914d7ab94e81be6355467c28

SHA512
a334833437f90028f9b812ed2634b2e6239e37acfdaad21c7904eace4e9bf5b17c3f8e1293c25f002486cd1fb3ab55a8dd720cc778c34b9daeffd292ad3e1377

Download Submit
\Windows\Temp\cacert.exe
Filesize
281KB

MD5
ab8ae66d02d1e0d8bcde85eb9eb9d10a

SHA1
5cc769447e0ec91b36fb2f9cde1e39de30baa8c8

SHA256
7626db12c55677596bbeaaf6f93ecead45f0a972914d7ab94e81be6355467c28

SHA512
a334833437f90028f9b812ed2634b2e6239e37acfdaad21c7904eace4e9bf5b17c3f8e1293c25f002486cd1fb3ab55a8dd720cc778c34b9daeffd292ad3e1377

Download Submit
memory/1532-75-0x00000000002C0000-0x0000000000301000-memory.dmp

Filesize
260KB

Download
memory/1532-76-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/1532-87-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads