cobaltstrike | ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6

General

Target

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
Size

467KB
MD5

0ee07e2b56702ded814ae6ebb1d71bdb
SHA1

c6e981a5cc70a4c7b9e95e7012a548295af7b8c8
SHA256

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6
SHA512

7885eab3128e526373f71398371221ea89362d1f12153e3d9fe7572c7cfd0248c8ca7db4fa611e05e21713cf7c1fa99d94f23565c018de90024d4af550ab907c
SSDEEP

6144:bXGow0x5mx+cIAm8z+0SyHuua0smOzOTO1dLG8t5qH+Ezc9kxS:bXbWx+7GzxSyHRTO1dLwg9

Score

10^/10

cobaltstrike 0 1 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1

C2

http://service-84pns6bl-1313036808.sh.apigw.tencentcs.com:443/passApi/html/_blank.html

Attributes

access_type
512
beacon_type
2048
host
service-84pns6bl-1313036808.sh.apigw.tencentcs.com,/passApi/html/_blank.html
http_header1
AAAACgAAABxVcGdyYWRlLUluc2VjdXJlLVJlcXVlc3RzOiAxAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAAFQU5JRD0AAAACAAAAGV9fU2VjdXJlLTNQQVBJU0lEPW5vc2tpbjsAAAABAAAAIztDT05TRU5UPVlFUytDTi56aC1DTisyMDIxMDkxNy0wOS0wAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOAAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAKAAAAGENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MAAAAAoAAAAfUmVmZXJlcjogaHR0cHM6Ly93d3cuYmFpZHUuY29tLwAAAAoAAAAcVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQAAAAcAAAAAAAAADQAAAAUAAAAIX19mb3JtaWQAAAAJAAAADmFwX2lkPWZrc2RVZEdXAAAACQAAABluZXdidXllcm5hbWU9bWJkWlNnSnZFR3BpAAAACQAAABZmaWVsZG5hbWU9RnNMS25hQ3VCdmVvAAAABwAAAAEAAAANAAAAAgAAAClhaWRfPTAwMDAwMDAwJmFjY3Zlcj0xJnNob3d0eXBlPWVtYmVkJnVhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
4864
polling_time
23000
port_number
443
sc_process32
%windir%\syswow64\gpupdate.exe
sc_process64
%windir%\sysnative\gpupdate.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC33yCNC2uDl2oF/7G/OAJ3tI+AtnoTswUevzbMAEN+J6KjwVNFPIvYf1/3a48X+yjayvtvV+7ZZmS+MsvGjaO6J4Mnecd9f5iKf+AZUM99ffVg4ropmfD/IX74fWTRnFx/30uQP80xx0vaHImFO7UWyPvre0kVziipP1xJWMIUBwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.481970944e+09
unknown2
AAAABAAAAAEAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/v2/api/
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
watermark
1

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

pid	process
2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1752 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

1752 WINWORD.EXE
1752 WINWORD.EXE
1752 WINWORD.EXE
1752 WINWORD.EXE
1752 WINWORD.EXE
1752 WINWORD.EXE

pid	process
1752	WINWORD.EXE

pid	process
1752	WINWORD.EXE
1752	WINWORD.EXE
1752	WINWORD.EXE
1752	WINWORD.EXE
1752	WINWORD.EXE
1752	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

description	pid	process	target process
PID 2880 wrote to memory of 1752	2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe	WINWORD.EXE
PID 2880 wrote to memory of 1752	2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe	WINWORD.EXE
PID 2880 wrote to memory of 1752	2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe	WINWORD.EXE
PID 2880 wrote to memory of 1752	2880	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
"C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2880

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.doc"
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.doc
Filesize
51KB

MD5
7e71c1722cc9d71f6d9aca89d32f8890

SHA1
908e7de2da70f3bc25584921d6daa31e8ee52e83

SHA256
eba809e2fa0c23526b79c54718f27ca4b67793e3f06bd3a242f0badd14cd0461

SHA512
bfc120f9979b11a835a21dce9fb574c986cbb90f35c666a55272f6927e8cbf929b54d09ae2f0a9a4707869cdd038292db263f67591cacdc654c3343bada17ded

Download Submit
memory/1752-1-0x000000002F571000-0x000000002F572000-memory.dmp

Filesize
4KB

Download
memory/1752-2-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1752-7-0x000000007104D000-0x0000000071058000-memory.dmp

Filesize
44KB

Download
memory/2880-6-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2880-5-0x000007FEF69D0000-0x000007FEF6A7C000-memory.dmp

Filesize
688KB

Download
memory/2880-10-0x000007FEF69D0000-0x000007FEF6A7C000-memory.dmp

Filesize
688KB

Download
memory/2880-12-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads