cobaltstrike | 4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d

General

Target

4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe
Size

724KB
MD5

bde91a78424fd430ff76a35e0f13b261
SHA1

f30cd68daf082becf0eac8efaaeb4bfe14396144
SHA256

4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d
SHA512

465df8a1e6878c1bcc886db6cd194d535e9f4db27c1cc197b4708b331d0d02dbe06a78e0c2394f0f2c7550ccf84ad9fecc9c55d88129ce68a486d3f4027e0f9a
SSDEEP

12288:PqhYIofbUkXpagXo2+S+TRclgcPyxXAMr7GzC8tnfESG9W1SOkOWZm2SZYiZBKPX:PO50YkW2+NTRiqxwpzdZsSVsOmmR3Zk3

Score

10^/10

cobaltstrike 426352781 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

C2

http://pypi.python.org:443/latest/pip-check

Attributes

access_type
512
beacon_type
2048
host
pypi.python.org,/latest/pip-check
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfUmVmZXJlcjogaHR0cDovL3d3dy5weXRob24ub3JnLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAANAAAAAgAAAAdfX3V0bXo9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfUmVmZXJlcjogaHR0cDovL3d3dy5weXRob24ub3JnLwAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAPAAAADQAAAAUAAAAGX191dG16AAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2560
polling_time
1000
port_number
443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCmV0fCtMxIXtGF3+FyYKSiU1yVjtm3FlG6Mej3iMRBgSTd45Sa41JLXaoOjKxePWNN4wyUUInzIPEYA6fdx4N/+zwru33xzNAdipcbN3RLZg8v3s8Zu6vVXoj7apcBJy2ObQsYhoYAialaTKe4dWOVnbUJK46Ve8gDPeudH52IRQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.733629184e+09
unknown2
AAAABAAAAAEAAAACAAAAAgAAAAoAAAACAAAAAAAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/latest/check
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36
watermark
426352781

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings	4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3100 WINWORD.EXE
3100 WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE
3100	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe

description	pid	process	target process
PID 3232 wrote to memory of 3100	3232	4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe	WINWORD.EXE
PID 3232 wrote to memory of 3100	3232	4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe
"C:\Users\Admin\AppData\Local\Temp\4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3232

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.doc" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:8
1⤵
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4a438626ac962db91cde46ee2c04c850b46262599bc535b4a08209661d5fb44d.doc
Filesize
276KB

MD5
5a4fdb2646076d704d740327a6a88030

SHA1
9126f323d106423f7f7a70a42718ff0256ebdba7

SHA256
c7ea88d6c634b9e01735d62bd272997183e217b1929000bc723c4e052a970e45

SHA512
dad0355d1ddf50f23fab77991a1d0e926396b70976c2c23ced2cc417ae935ddae37cd9eab280b2174a139a67f58005311753290b156ac94d175977117b409014

Download Submit
memory/3100-20-0x00007FFC55A70000-0x00007FFC55A80000-memory.dmp

Filesize
64KB

Download
memory/3100-21-0x00007FFC55A70000-0x00007FFC55A80000-memory.dmp

Filesize
64KB

Download
memory/3100-22-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-23-0x00007FFC55A70000-0x00007FFC55A80000-memory.dmp

Filesize
64KB

Download
memory/3100-24-0x00007FFC55A70000-0x00007FFC55A80000-memory.dmp

Filesize
64KB

Download
memory/3100-25-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-26-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-27-0x00007FFC55A70000-0x00007FFC55A80000-memory.dmp

Filesize
64KB

Download
memory/3100-28-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-29-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-30-0x00007FFC53110000-0x00007FFC53120000-memory.dmp

Filesize
64KB

Download
memory/3100-31-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-32-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-33-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-34-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-37-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-36-0x00007FFC53110000-0x00007FFC53120000-memory.dmp

Filesize
64KB

Download
memory/3100-35-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-38-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-39-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-40-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-42-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-41-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-54-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3100-55-0x00007FFC959F0000-0x00007FFC95BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3232-57-0x000001BBD8DC0000-0x000001BBD8EC0000-memory.dmp

Filesize
1024KB

Download
memory/3232-58-0x000001BBD8C20000-0x000001BBD8C6E000-memory.dmp

Filesize
312KB

Download
memory/3232-59-0x000001BBD8DC0000-0x000001BBD8EC0000-memory.dmp

Filesize
1024KB

Download
memory/3232-60-0x000001BBD8C20000-0x000001BBD8C6E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads