cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
China's_gray_zone_warfare_against_Taiwan.doc.lnk
Size 1.4MB
Sample240719-ppn5ba1dpn
SHA256 2fa270cf83b341bc469b0d4430d2b5c3e95109b4b47f4f99c9e878aeaff8ec33
MD5 6f7d85c196c277a6a619f6d94b8f69b9
SHA1 530c0833454ca14c01af28961239cb07f783d977
SHA512 6bf3761c2157957d5f3349864b4905cf5f2d12f4aa1a78b5aa899de4e9a57544dabcafaf204443f2a85ca2041c94f3ecc95818445885b959b7fbf0bbd2a26f41
SSDEEP 24576:yfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5XF:4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 1 IoCs

pid	Process
1980	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
1980	pfexec.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1068	WINWORD.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1068	WINWORD.EXE
1980	pfexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	WINWORD.EXE
1068	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1964	2676	cmd.exe	31
PID 2676 wrote to memory of 1964	2676	cmd.exe	31
PID 2676 wrote to memory of 1964	2676	cmd.exe	31
PID 2900 wrote to memory of 2872	2900	explorer.exe	33
PID 2900 wrote to memory of 2872	2900	explorer.exe	33
PID 2900 wrote to memory of 2872	2900	explorer.exe	33
PID 2872 wrote to memory of 2716	2872	WScript.exe	34
PID 2872 wrote to memory of 2716	2872	WScript.exe	34
PID 2872 wrote to memory of 2716	2872	WScript.exe	34
PID 2716 wrote to memory of 2624	2716	cmd.exe	36
PID 2716 wrote to memory of 2624	2716	cmd.exe	36
PID 2716 wrote to memory of 2624	2716	cmd.exe	36
PID 2716 wrote to memory of 2396	2716	cmd.exe	37
PID 2716 wrote to memory of 2396	2716	cmd.exe	37
PID 2716 wrote to memory of 2396	2716	cmd.exe	37
PID 2716 wrote to memory of 2776	2716	cmd.exe	38
PID 2716 wrote to memory of 2776	2716	cmd.exe	38
PID 2716 wrote to memory of 2776	2716	cmd.exe	38
PID 2716 wrote to memory of 1068	2716	cmd.exe	39
PID 2716 wrote to memory of 1068	2716	cmd.exe	39
PID 2716 wrote to memory of 1068	2716	cmd.exe	39
PID 2716 wrote to memory of 1068	2716	cmd.exe	39
PID 2716 wrote to memory of 1980	2716	cmd.exe	40
PID 2716 wrote to memory of 1980	2716	cmd.exe	40
PID 2716 wrote to memory of 1980	2716	cmd.exe	40
PID 2716 wrote to memory of 1980	2716	cmd.exe	40
PID 1068 wrote to memory of 1948	1068	WINWORD.EXE	41
PID 1068 wrote to memory of 1948	1068	WINWORD.EXE	41
PID 1068 wrote to memory of 1948	1068	WINWORD.EXE	41
PID 1068 wrote to memory of 1948	1068	WINWORD.EXE	41

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\China's_gray_zone_warfare_against_Taiwan.doc.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" __MACOS\_params.cat.js
  2⤵
  PID:1964

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOS\_params.cat.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp > C:\Users\Admin\AppData\Roaming\wnMKDE.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\gmhqKH.tmp C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\system32\findstr.exe
      findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
      4⤵
      PID:2624
  - - \??\c:\windows\system32\certutil.exe
      c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
      4⤵
      PID:2396
  - - C:\Windows\system32\expand.exe
      expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\
      4⤵
      Drops file in Windows directory
      PID:2776
  - - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc"
      4⤵
      Drops file in Windows directory
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:1948
  - - C:\Users\Admin\AppData\Roaming\pfexec.exe
      C:\Users\Admin\AppData\Roaming\pfexec.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

China's_gray_zone_warfare_against_Taiwan.doc

Path C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc
Size 75KB
SHA256 156eec85df18e7ff992a5bf35c97938557ac506c2306a8cb6633602d8a6568ed
MD5 16578aeab36f8c8f72d1a858ec21fd9c
SHA1 78f2d46da970d00033a483d0098ba9e106694321
SHA512 7e5171f365ea40e095dc6431a7598baeca21b46a52ca53a56e8124c4b41b6f3fd6f8f2afc0cf4db6b30da5a71e72a3451c53074681ed0cc5893db4fbf8f6a6e9
SSDEEP 768:Ltwiwp2CLsNgrnt7GcQ3/JGk8oBX3WJ3mF0z3wrtwcFwDdxz99:LtNCINmGcQ3Rh8+X3WJWF0z3wqcSDd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 19KB
SHA256 9ff44f7c318f609ce2eac079ce3de3d896ec43d7aef1002171589aedb2a00e0f
MD5 a74dc14c8acc8f71b06a9ed9184a4285
SHA1 6ecd66255d613584e80b7c0d5be6b765a7b72932
SHA512 6020a185537bb64cc02adaaea4a07fedc5ef4e6264b57cb14dfe77eef1e0b8b61c21747ac2c5eaafc9bb60446944d81e7f6ce430d52fe60faf0e332e53e376e2
SSDEEP 384:Pjl/SU5XLY2V+raUpIIvG6F7//ooOoVLrR9rKS6lIABLXMAPIrp:JF/Ue4RFmSUsAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

gmhqKH.tmp

Path C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
Size 1.4MB
SHA256 9afb6689a659f6b963d5273bab3bc7bddde88d8a00f5ee12eebffe1926b650c8
MD5 05d9845ccaa230a1f69c75b4ef0e74e3
SHA1 b0acfc3e20e14c6d444e879a6a3e54bff72df005
SHA512 0ddaa8676b788f7ac79a477bf4707ea05207a12fa4b37f3898bef4f624ceea45cd16b1bd5b29ec9de9274814725cebb793feb63551d8a62b8172efd8d6595b5c
SSDEEP 24576:bfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5Xc:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuhswb.tmp

Path \??\c:\users\admin\appdata\roaming\yuhswb.tmp
Size 741KB
SHA256 2fe53a6d753eb0e288b0e514b5668ed13749227da65cd346c144c0cf8e438974
MD5 2f9c9af52d5a3c25363bb288fa997f21
SHA1 0d1a1bf7f13f16ba38fe96cbf22f06b0e38edf19
SHA512 a8e6cc507d9d6a2477b153dc2ebac284b4125ca9ee54d7484cf9bb5b36393b2747681b30b53d5a4fe47d152a23f60a50de72a1a313048cf90dd21a4ddc591924
SSDEEP 12288:lh5vSW+hDwS8Nn0NlpDnBHauPOBmIOAxcvWIpnMbhuDlWpHIqMRKbet:lLGUSyn09tHauPOQXAxcuIlMbh4WFIqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path \Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-79-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1068-125-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1980-98-0x00000000000F0000-0x0000000000124000-memory.dmp

Download

memory/1980-99-0x00000000003D0000-0x0000000000458000-memory.dmp

Download

memory/1980-109-0x00000000003D0000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads