cobaltstrike | a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe

General

Target

a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe
Size

393KB
MD5

c24b006757a1547f186ae964692d6ced
SHA1

9aaf71667f51d5370097e67af437ebd4a1706d17
SHA256

a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe
SHA512

44814cac7370ab690f2d24e3e4b911b96a1bf9b324f85ac59cbcbbae3acc06c99b321060ffa921e313c6369293e7cc845d9ff97b147299d712d2b31b92252d96
SSDEEP

6144:OgZiAEAO0sByNsAal3gVAWgS7/Ohwj3ulclvo7sxExUkK:OgZXEAO/BUdG3gVdt7KSwivouESH

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://120.55.183.201:8001/NAVx

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSE)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe

Executes dropped EXE 1 IoCs

Processes:

360installer.exe

pid process

2732 360installer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2732	360installer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3212 WINWORD.EXE
3212 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

3212 WINWORD.EXE
3212 WINWORD.EXE
3212 WINWORD.EXE
3212 WINWORD.EXE
3212 WINWORD.EXE
3212 WINWORD.EXE
3212 WINWORD.EXE

pid	process
3212	WINWORD.EXE
3212	WINWORD.EXE

pid	process
3212	WINWORD.EXE
3212	WINWORD.EXE
3212	WINWORD.EXE
3212	WINWORD.EXE
3212	WINWORD.EXE
3212	WINWORD.EXE
3212	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe

description	pid	process	target process
PID 1856 wrote to memory of 2732	1856	a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe	360installer.exe
PID 1856 wrote to memory of 2732	1856	a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe	360installer.exe
PID 1856 wrote to memory of 3212	1856	a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe	WINWORD.EXE
PID 1856 wrote to memory of 3212	1856	a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe
"C:\Users\Admin\AppData\Local\Temp\a97f8afdf91943ab21197651c155a799d386fa6f84f457b1fa6eaf23f7ecc3fe.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\Temp\360installer.exe
"C:\Windows\Temp\360installer.exe"
2⤵
- Executes dropped EXE
PID:2732

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\Temp\简历.docx" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD954D.tmp\gb.xsl
Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
213B

MD5
f1ffab34158e0ad765f3664d18de1c7b

SHA1
2eb0b93e86b507b631d226700b241aaa101dda89

SHA256
26ff1740ecb187432b7902f886d16c5b239c753dc250aa1a6eae65b1d7c26fb5

SHA512
6615722348ea405413d3eab7ace5978cbdde9dc9636f0499f63b3ab2743f00effbcf26ed4f8962d60f414f52565141f96779709a30a409972c9fa12b2686c798

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
3c6d369d71bfaf603999be85d2353159

SHA1
0122dc835e696b3e80098afa9fe6eab1e40d4ec3

SHA256
82d9bc0ad05d923245efd133d55cd724cf4148edf637279dd1dd174336b4d625

SHA512
c3a0b53ff938289ba3949cceb237ec0273a515d5fea1dc785d3a6f384dfdc3e2c8b5d946293c932252a527cb6dad03d427289ab85c4b6b1495e5a8069baad684

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
0eb005bd403f797c90c0ba3e228242f3

SHA1
e6d60fe096f529966effd8f59c9056321a36cecb

SHA256
527ad617a51a4e4108c110e58b3f162f1f18279689192676d53a36da329d0d5f

SHA512
43fb001ba01be9a12b9fae68dda09bb827b21f6d3fa2af553e4662480a40fbcad3f991cccdff3f5a9eebb663e0de4ff382017cc29d78c3bab0e5b53b57fd1d44

Download Submit
C:\Windows\Temp\360installer.exe
Filesize
19KB

MD5
b14b4aec464c9ae51915d0a11e843746

SHA1
14b4e6f400f7599136966efa39fb4b400d982828

SHA256
30bf7d9f35a3d109e6ec99328fc9e89d166833cb9aa94355a7504fedef9d27c6

SHA512
047dbbc21ed3d383cba517ded6567f74918c5068e23350c5be6efa9e4e0f088c3a6361f5b5e35ec95fb11caba90293844abda537b4e13287e9fc58f946f7e218

Download Submit
C:\Windows\Temp\简历.docx
Filesize
15KB

MD5
59d1896c340ac5d73950d2a9f9e03d77

SHA1
06de955535148cec88273131c955a64f94c5d7dc

SHA256
7aea3dd9dc4b3df8ee7989076c6134e8c841bad1e274c6fbae7479aa6dc11c18

SHA512
75c85e14720336cfbc157f150090255763a41ef7b27f694702231ec269ba6c16f1f0039b48dece47f0672656c59d2b6b8ab2c5294210e34ca285dbc297b73bbd

Download Submit
memory/2732-32-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2732-54-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3212-19-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-20-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-21-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-23-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-25-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-24-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-29-0x00007FF949C10000-0x00007FF949C20000-memory.dmp

Filesize
64KB

Download
memory/3212-28-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-30-0x00007FF949C10000-0x00007FF949C20000-memory.dmp

Filesize
64KB

Download
memory/3212-27-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-26-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-22-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-18-0x00007FF98C30D000-0x00007FF98C30E000-memory.dmp

Filesize
4KB

Download
memory/3212-17-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-15-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-16-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-14-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-545-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download
memory/3212-574-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-575-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-577-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-576-0x00007FF94C2F0000-0x00007FF94C300000-memory.dmp

Filesize
64KB

Download
memory/3212-578-0x00007FF98C270000-0x00007FF98C465000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads