cobaltstrike | 75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6

Sharing

Copy URL Twitter E-mail

General

Target
75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6
Size 111KB
Sample240715-vpq7katcld
SHA256 75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6
MD5 2615318fdc206f9ce564e3c773a48de0
SHA1 bd737358cc4c4eb8cb008f53b6f08f49d4807b06
SHA512 d2edb6f1c2af3de30fe0dd90a3215b4709d8b37502895420721887ea0c2327f0b5afc655c61f70c33b9b0c731c88a8ff013da2274970eb93abbb06ee24ead2f8
SSDEEP 3072:4WX5qakqEw7KO3+haHhfm9+GrcMGHc2kvnY+WX:dXh9Ew7jHRm9wT82kvnYRX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

6 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://192.168.29.129:7777/activity

Attributes

access_type
512
host
192.168.29.129,/activity
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
7777
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIPhP1QnI+l3wNxQUZMFxHjV+eD8F+bCxzPv+kNInFYmkkWDg6ZMhCEYfdrdPooYTSLMynYGlEuRv584h17DzW3vmG1mWb1NshP1Op7CJJumdau73LAOR4triqqONpoirizvhhyypo8cKXMZ6ASBfsM4NMiwK+Nb5FCyjCgGiTfQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)
watermark
6

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
static1/unpack001/bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81

File Explorer

75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6

.zip 111KB
bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81

.dll 208KB

75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6

SHA256 75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6
MD5 2615318fdc206f9ce564e3c773a48de0
SHA1 bd737358cc4c4eb8cb008f53b6f08f49d4807b06
SHA512 d2edb6f1c2af3de30fe0dd90a3215b4709d8b37502895420721887ea0c2327f0b5afc655c61f70c33b9b0c731c88a8ff013da2274970eb93abbb06ee24ead2f8
SSDEEP 3072:4WX5qakqEw7KO3+haHhfm9+GrcMGHc2kvnY+WX:dXh9Ew7jHRm9wT82kvnYRX
MD5 SHA1 SHA512 SSDEEP

Password

infected

bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81

IMPHASH a4a13f49eed906223a6a04bbd4affb28
SHA256 bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81
MD5 95b2404b2fb3401ccefca83be859f448
SHA1 e0ba8b21b94d1325f470ab7b6cc1bc282c0fab5f
SHA512 d0a6c29606637864cd66b163d97d473a82eadaa2123f95d05fa219feee8abb8f861fbd0531525d7f7290af66281b80ec6ddc99dbcd03062afa5bc7e6dbf17fcb
SSDEEP 3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUM5njAj:ZwXupN1x8CgBbRLDTuLjh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetThreadContext ReadProcessMemory CreateProcessA TerminateProcess GetCurrentDirectoryW VirtualProtectEx WriteProcessMemory ResumeThread GetFullPathNameA SystemTimeToTzSpecificLocalTime GetLogicalDrives ExpandEnvironmentStringsA GetFileAttributesA FileTimeToSystemTime FindFirstFileA CopyFileA FindClose MoveFileA FindNextFileA VirtualProtect OpenProcess GetCurrentProcessId Thread32First Thread32Next VirtualAllocEx OpenThread CreateToolhelp32Snapshot CreateThread CreateRemoteThread SetThreadContext MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError GetVersionExA CreateFileA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetComputerNameA GetACP GetModuleFileNameA GetOEMCP DeleteProcThreadAttributeList HeapAlloc CreateNamedPipeA GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId DuplicateHandle Process32First Process32Next VirtualQuery ExitProcess ExitThread ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetCurrentDirectoryA CreatePipe GetLocalTime GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe MultiByteToWideChar WriteFile GetTickCount WaitForSingleObject Sleep GetModuleHandleA DebugBreak RaiseException SetEnvironmentVariableW GetModuleFileNameW LoadLibraryA VirtualAlloc GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer VirtualFree HeapFree FreeLibrary GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetFileType

advapi32

LookupAccountSidA OpenThreadToken CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx OpenProcessToken GetTokenInformation GetUserNameA CreateProcessWithTokenW CreateProcessWithLogonW CreateProcessAsUserA AdjustTokenPrivileges ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA

wininet

InternetSetOptionA InternetConnectA InternetQueryDataAvailable InternetReadFile HttpOpenRequestA HttpAddRequestHeadersA InternetSetStatusCallback HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA

ws2_32

gethostbyname send WSAIoctl WSAStartup WSACleanup socket WSASocketA ntohl htons htonl connect ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind select closesocket