cobaltstrike | 41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8

General

Target

41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe
Size

565KB
MD5

11f483182a6d4f1a0dd2682e58b4eaf0
SHA1

57ebd92b2f0c2269a3aa1aea74498a44041ecc75
SHA256

41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8
SHA512

028e321cf5bdde26660f98477fbbc23607f48a724ecbfd6041969828c09b10e0f0603c1551f63f998a9b6c4964363bbd6f4b4fbd2fea07bc2f42fe57fdaca144
SSDEEP

6144:8M1HMUCuFyhyGUKnjZ0dxuhUMA3eIJuMPJCVy+tPXbLE8x/RSI2SS:8MaUCAwUMZ0PRJZMBPbLE8x

Score

10^/10

cobaltstrike 426352781 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://www.vietsovspeedtest.com:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
2048
host
www.vietsovspeedtest.com,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAABAAAAAeSG9zdDogd3d3LnZpZXRzb3ZzcGVlZHRlc3QuY29tAAAABwAAAAAAAAADAAAAAgAAAA5zZXNzaW9uLXRva2VuPQAAAAIAAAAMc2tpbj1ub3NraW47AAAAAQAAACxjc20taGl0PXMtMjRLVTExQkI4MlJaU1lHSjNCREt8MTQxOTg5OTAxMjk5NgAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAQAAAAHkhvc3Q6IHd3dy52aWV0c292c3BlZWR0ZXN0LmNvbQAAAAkAAAAKc3o9MTYweDYwMAAAAAkAAAARb2U9b2U9SVNPLTg4NTktMTsAAAAHAAAAAAAAAAUAAAACc24AAAAJAAAABnM9MzcxNwAAAAkAAAAiZGNfcmVmPWh0dHAlM0ElMkYlMkZ3d3cuYW1hem9uLmNvbQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\mstsc.exe
sc_process64
%windir%\sysnative\mstsc.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGZQE/ydtndkV2dxaiulzRfeiGbSezhRB4m/gYcGkmSmo+BzksdxaYy2rWS4PMcYtvUME1tLauZnhDGlzmaWa8L1ilL3LIXq7FC5D/ItspPr3JcHWHjDLY2Trymhb8oIZaBWUc0Q+TgLi32ID+K5PpJAaj9Qkg1Us8sp5pA4+HTQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
426352781

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2464 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

2464 WINWORD.EXE
2464 WINWORD.EXE
2464 WINWORD.EXE
2464 WINWORD.EXE
2464 WINWORD.EXE
2464 WINWORD.EXE
2464 WINWORD.EXE

pid	process
2464	WINWORD.EXE

pid	process
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe

description	pid	process	target process
PID 2876 wrote to memory of 2464	2876	41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe	WINWORD.EXE
PID 2876 wrote to memory of 2464	2876	41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe	WINWORD.EXE
PID 2876 wrote to memory of 2464	2876	41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe	WINWORD.EXE
PID 2876 wrote to memory of 2464	2876	41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe
"C:\Users\Admin\AppData\Local\Temp\41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.docx"
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\41bcdc3fc4c878fb34ebebeff6ff7d158be166d3fc220f3b90f225ae3757f2e8.docx
Filesize
113KB

MD5
66d160ab553ff1a90af31b851dc0a108

SHA1
c39e723e18914280f5420573e58264e640e895ab

SHA256
d868970f1f89fcd01c0ef7fcdeac90696e3248796cec927b39e0ea5f1db7001d

SHA512
cdccca152014e1c0628e4af16979e9927940fecef940a1dcb370130c0906cb0826926e3084e450674475774bb546776026bd870f66f689530e724a88c98f5aca

Download Submit
memory/2464-1-0x000000002FA41000-0x000000002FA42000-memory.dmp

Filesize
4KB

Download
memory/2464-2-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2464-3-0x0000000070F0D000-0x0000000070F18000-memory.dmp

Filesize
44KB

Download
memory/2464-9-0x0000000070F0D000-0x0000000070F18000-memory.dmp

Filesize
44KB

Download
memory/2876-7-0x000000013F2E0000-0x000000013F376000-memory.dmp

Filesize
600KB

Download
memory/2876-21-0x00000000021A0000-0x0000000002220000-memory.dmp

Filesize
512KB

Download
memory/2876-22-0x00000000021A0000-0x0000000002220000-memory.dmp

Filesize
512KB

Download
memory/2876-23-0x0000000002220000-0x000000000226E000-memory.dmp

Filesize
312KB

Download
memory/2876-24-0x000000013F2E0000-0x000000013F376000-memory.dmp

Filesize
600KB

Download
memory/2876-26-0x00000000021A0000-0x0000000002220000-memory.dmp

Filesize
512KB

Download
memory/2876-27-0x0000000002220000-0x000000000226E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing