cobaltstrike | 3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1

General

Target

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe
Size

4.0MB
MD5

9aad734bc59b22f393ae53220546f025
SHA1

36967195eca702a09b39108d9a9b91a8f4b5685f
SHA256

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1
SHA512

134f752a79e165056126a34b19f90d472f3de4b43ecbc4705d0751609056cba128caf74208dd34ce1fafe19d056be7a3c632f1e36abdf4258d00ef7e5e6bf329
SSDEEP

98304:qDLdL1cx6SgTFmbV39IRS9OZC3N6UHY6y6ndu:0L3cxiFmbtqQxjD

Score

10^/10

cobaltstrike 0 426352781 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://docs.python.org:443/3/_static/documentation_options.js

Attributes

access_type
512
beacon_type
2048
host
docs.python.org,/3/_static/documentation_options.js
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfUmVmZXJlcjogaHR0cDovL3d3dy5weXRob24ub3JnLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAdfX3V0bXo9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfUmVmZXJlcjogaHR0cDovL3d3dy5weXRob24ub3JnLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAGX191dG16AAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2560
polling_time
1000
port_number
443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyXvw9mY/QkP1Wh8AN0IsHib9vHQHvto8stMBDs1V4eKwF4XsKjkbOVrUHNk1kYcKXxfTrEFtUqQ1uOd5UUThdsbkZRNfX6mQdVr8KlUfdtGt3HpbTfp/YHAKPcXY4mxxzJ81rm77RYELtClUY8VsHwU4cXaJzRV1zD75ZmG8+iQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.733629184e+09
unknown2
AAAABAAAAAEAAAACAAAAAgAAAAoAAAACAAAAAAAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/3/_static
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36
watermark
426352781

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2324 AcroRd32.exe
2324 AcroRd32.exe
2324 AcroRd32.exe

pid	process
2324	AcroRd32.exe
2324	AcroRd32.exe
2324	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe

description	pid	process	target process
PID 840 wrote to memory of 2324	840	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe
PID 840 wrote to memory of 2324	840	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe
PID 840 wrote to memory of 2324	840	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe
PID 840 wrote to memory of 2324	840	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe
"C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.pdf"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
242B

MD5
8ec2919de0e33ccb0e33fd4742327ed3

SHA1
f5160363a8dbe9378a1e9fd2b320e375464b51fd

SHA256
5c40a7fbbc9a7ed4e0ae810d5434674891dcb1a7c11767eda3cd7111bd8ac63d

SHA512
2d1b23f2855ee5f43dfea0dbc11602c56b4df9762ad28039c90b5a3aa561fcdbf11de5a905dffec03ccbb017393652aa03f065d048684a3988818b417f6f41af

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.pdf
Filesize
3.5MB

MD5
22b3e9808f5aa793ef91198ef60f5b94

SHA1
e3b6e5c2a18d1b6df0875d68a3d9501d315f3356

SHA256
379499f27196f12628a813e0959f58afef77c1714c6822156b23379e3aab4939

SHA512
b5bb2289172d8eb9f12c85777b66d4c27ebbd9fd24df8c39c5f7ca48b680e430d13a26c6aa0f505fe7a2eebe57f3fda4683e58bcfb07e5829ceee2afc4a8594d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC920.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
817b7f6a63c3e9c5f9d6de6af22fc5ba

SHA1
ba4e6c9a4448046d93f4af0157e84bc4177e83f6

SHA256
7018313715fbbf0a6d09fddd70a2ec9344f061d6a0986243bedd3ed7c2703bdf

SHA512
d3e50f2ad675d5d20650d9e989e5b7c3fc6d753345dccf6c10a150be4764a726d80ad7fec4d9a3ab380abfabc352b7d4bfcce8cb5b46b21e7d08ed68d5e4ca61

Download Submit
memory/840-30-0x000000013F5B0000-0x000000013F9B3000-memory.dmp

Filesize
4.0MB

Download
memory/840-34-0x0000000002500000-0x0000000002580000-memory.dmp

Filesize
512KB

Download
memory/840-35-0x0000000002500000-0x0000000002580000-memory.dmp

Filesize
512KB

Download
memory/840-36-0x0000000002370000-0x00000000023BE000-memory.dmp

Filesize
312KB

Download
memory/840-344-0x000000013F5B0000-0x000000013F9B3000-memory.dmp

Filesize
4.0MB

Download
memory/840-842-0x0000000002500000-0x0000000002580000-memory.dmp

Filesize
512KB

Download
memory/840-843-0x0000000002500000-0x0000000002580000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads