cobaltstrike | 3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe
Size

4.0MB
MD5

9aad734bc59b22f393ae53220546f025
SHA1

36967195eca702a09b39108d9a9b91a8f4b5685f
SHA256

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1
SHA512

134f752a79e165056126a34b19f90d472f3de4b43ecbc4705d0751609056cba128caf74208dd34ce1fafe19d056be7a3c632f1e36abdf4258d00ef7e5e6bf329
SSDEEP

98304:qDLdL1cx6SgTFmbV39IRS9OZC3N6UHY6y6ndu:0L3cxiFmbtqQxjD

Score

10^/10

cobaltstrike 0 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4444 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4444 AcroRd32.exe
4444 AcroRd32.exe
4444 AcroRd32.exe
4444 AcroRd32.exe

pid	process
4444	AcroRd32.exe

pid	process
4444	AcroRd32.exe
4444	AcroRd32.exe
4444	AcroRd32.exe
4444	AcroRd32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe

description	pid	process	target process
PID 3976 wrote to memory of 4444	3976	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe
PID 3976 wrote to memory of 4444	3976	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe
PID 3976 wrote to memory of 4444	3976	3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe
"C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3976

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.pdf"
2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3576 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:2432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ba81d78f3b764dc6e369f24196c41b4cba0764414ad85d42dae5a5f79e871e1.pdf
Filesize
3.5MB

MD5
22b3e9808f5aa793ef91198ef60f5b94

SHA1
e3b6e5c2a18d1b6df0875d68a3d9501d315f3356

SHA256
379499f27196f12628a813e0959f58afef77c1714c6822156b23379e3aab4939

SHA512
b5bb2289172d8eb9f12c85777b66d4c27ebbd9fd24df8c39c5f7ca48b680e430d13a26c6aa0f505fe7a2eebe57f3fda4683e58bcfb07e5829ceee2afc4a8594d

Download Submit
memory/3976-8-0x00007FF6149E0000-0x00007FF614DE3000-memory.dmp

Filesize
4.0MB

Download
memory/3976-12-0x0000023AE5F50000-0x0000023AE6050000-memory.dmp

Filesize
1024KB

Download
memory/3976-13-0x0000023AE5B00000-0x0000023AE5B4E000-memory.dmp

Filesize
312KB

Download
memory/3976-14-0x00007FF6149E0000-0x00007FF614DE3000-memory.dmp

Filesize
4.0MB

Download
memory/3976-16-0x0000023AE5F50000-0x0000023AE6050000-memory.dmp

Filesize
1024KB

Download
memory/3976-17-0x0000023AE5B00000-0x0000023AE5B4E000-memory.dmp

Filesize
312KB

Download