cobaltstrike | ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6

General

Target

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
Size

467KB
MD5

0ee07e2b56702ded814ae6ebb1d71bdb
SHA1

c6e981a5cc70a4c7b9e95e7012a548295af7b8c8
SHA256

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6
SHA512

7885eab3128e526373f71398371221ea89362d1f12153e3d9fe7572c7cfd0248c8ca7db4fa611e05e21713cf7c1fa99d94f23565c018de90024d4af550ab907c
SSDEEP

6144:bXGow0x5mx+cIAm8z+0SyHuua0smOzOTO1dLG8t5qH+Ezc9kxS:bXbWx+7GzxSyHRTO1dLwg9

Score

10^/10

cobaltstrike 0 1 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1

C2

http://service-84pns6bl-1313036808.sh.apigw.tencentcs.com:443/passApi/html/_blank.html

Attributes

beacon_type
2048
host
service-84pns6bl-1313036808.sh.apigw.tencentcs.com,/passApi/html/_blank.html
http_header1
AAAACgAAABxVcGdyYWRlLUluc2VjdXJlLVJlcXVlc3RzOiAxAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAADQAAAAIAAAAFQU5JRD0AAAACAAAAGV9fU2VjdXJlLTNQQVBJU0lEPW5vc2tpbjsAAAABAAAAIztDT05TRU5UPVlFUytDTi56aC1DTisyMDIxMDkxNy0wOS0wAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOAAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAKAAAAGENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MAAAAAoAAAAfUmVmZXJlcjogaHR0cHM6Ly93d3cuYmFpZHUuY29tLwAAAAoAAAAcVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQAAAAcAAAAAAAAADQAAAAUAAAAIX19mb3JtaWQAAAAJAAAADmFwX2lkPWZrc2RVZEdXAAAACQAAABluZXdidXllcm5hbWU9bWJkWlNnSnZFR3BpAAAACQAAABZmaWVsZG5hbWU9RnNMS25hQ3VCdmVvAAAABwAAAAEAAAANAAAAAgAAAClhaWRfPTAwMDAwMDAwJmFjY3Zlcj0xJnNob3d0eXBlPWVtYmVkJnVhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
4864
polling_time
23000
port_number
443
sc_process32
%windir%\syswow64\gpupdate.exe
sc_process64
%windir%\sysnative\gpupdate.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC33yCNC2uDl2oF/7G/OAJ3tI+AtnoTswUevzbMAEN+J6KjwVNFPIvYf1/3a48X+yjayvtvV+7ZZmS+MsvGjaO6J4Mnecd9f5iKf+AZUM99ffVg4ropmfD/IX74fWTRnFx/30uQP80xx0vaHImFO7UWyPvre0kVziipP1xJWMIUBwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.481970944e+09
unknown2
AAAABAAAAAEAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/v2/api/
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
watermark
1

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

pid	process
620	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
620	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
620	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4640 WINWORD.EXE
4640 WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe

description	pid	process	target process
PID 620 wrote to memory of 4640	620	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe	WINWORD.EXE
PID 620 wrote to memory of 4640	620	ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe
"C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:620

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.doc" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ed649e6bd2bbf3a6e0788a459505a2231c92c736f1941c3b3f7c72f7b0ed5cb6.doc
Filesize
51KB

MD5
7e71c1722cc9d71f6d9aca89d32f8890

SHA1
908e7de2da70f3bc25584921d6daa31e8ee52e83

SHA256
eba809e2fa0c23526b79c54718f27ca4b67793e3f06bd3a242f0badd14cd0461

SHA512
bfc120f9979b11a835a21dce9fb574c986cbb90f35c666a55272f6927e8cbf929b54d09ae2f0a9a4707869cdd038292db263f67591cacdc654c3343bada17ded

Download Submit
memory/620-35-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-72-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-70-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-68-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-66-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-60-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-57-0x000001EF5A600000-0x000001EF5A700000-memory.dmp

Filesize
1024KB

Download
memory/620-55-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-51-0x00007FF9534B0000-0x00007FF95353D000-memory.dmp

Filesize
564KB

Download
memory/620-42-0x000001EF5A600000-0x000001EF5A700000-memory.dmp

Filesize
1024KB

Download
memory/4640-36-0x00007FF91FCF0000-0x00007FF91FD00000-memory.dmp

Filesize
64KB

Download
memory/4640-28-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-31-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-29-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-37-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-34-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-38-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-39-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-41-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-32-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-40-0x00007FF91FCF0000-0x00007FF91FD00000-memory.dmp

Filesize
64KB

Download
memory/4640-26-0x00007FF921FD0000-0x00007FF921FE0000-memory.dmp

Filesize
64KB

Download
memory/4640-27-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-56-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-25-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-24-0x00007FF921FD0000-0x00007FF921FE0000-memory.dmp

Filesize
64KB

Download
memory/4640-23-0x00007FF961F50000-0x00007FF962145000-memory.dmp

Filesize
2.0MB

Download
memory/4640-22-0x00007FF921FD0000-0x00007FF921FE0000-memory.dmp

Filesize
64KB

Download
memory/4640-21-0x00007FF921FD0000-0x00007FF921FE0000-memory.dmp

Filesize
64KB

Download
memory/4640-20-0x00007FF921FD0000-0x00007FF921FE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads