cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
131s
max time network
89s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
China_paper.pdf.lnk
Size 1.7MB
Sample240719-ppn5ba1dpn
SHA256 b7afa2662f99edcda4be8539fcc6149176f3cb241a724932cadda4088ca695ea
MD5 b04d484d1e1d793b04af2a5fb88a8a57
SHA1 e25ca637223300856f721d2d894589644069e2f8
SHA512 93092c56d381c6ae2f1526c91f1221824f6a135ef9515e37f64c483a265dd2a38155c966582d055a57e19a92ca38d4b4ae71fdd50edb079af5b279be96d9a3aa
SSDEEP 24576:5E4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdkA:C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution link pdf trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 1 IoCs

pid	Process
2932	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	pfexec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral3/files/0x0005000000019440-81.dat	pdf_with_link_action

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1968	AcroRd32.exe
2932	pfexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2832	3048	cmd.exe	31
PID 3048 wrote to memory of 2832	3048	cmd.exe	31
PID 3048 wrote to memory of 2832	3048	cmd.exe	31
PID 2916 wrote to memory of 2880	2916	explorer.exe	33
PID 2916 wrote to memory of 2880	2916	explorer.exe	33
PID 2916 wrote to memory of 2880	2916	explorer.exe	33
PID 2880 wrote to memory of 2680	2880	WScript.exe	34
PID 2880 wrote to memory of 2680	2880	WScript.exe	34
PID 2880 wrote to memory of 2680	2880	WScript.exe	34
PID 2680 wrote to memory of 2644	2680	cmd.exe	36
PID 2680 wrote to memory of 2644	2680	cmd.exe	36
PID 2680 wrote to memory of 2644	2680	cmd.exe	36
PID 2680 wrote to memory of 2684	2680	cmd.exe	37
PID 2680 wrote to memory of 2684	2680	cmd.exe	37
PID 2680 wrote to memory of 2684	2680	cmd.exe	37
PID 2680 wrote to memory of 2712	2680	cmd.exe	38
PID 2680 wrote to memory of 2712	2680	cmd.exe	38
PID 2680 wrote to memory of 2712	2680	cmd.exe	38
PID 2680 wrote to memory of 1968	2680	cmd.exe	39
PID 2680 wrote to memory of 1968	2680	cmd.exe	39
PID 2680 wrote to memory of 1968	2680	cmd.exe	39
PID 2680 wrote to memory of 1968	2680	cmd.exe	39
PID 2680 wrote to memory of 2932	2680	cmd.exe	40
PID 2680 wrote to memory of 2932	2680	cmd.exe	40
PID 2680 wrote to memory of 2932	2680	cmd.exe	40
PID 2680 wrote to memory of 2932	2680	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\China_paper.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" __MACOS\_params2.cat.js
  2⤵
  PID:2832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOS\_params2.cat.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp > C:\Users\Admin\AppData\Roaming\Yvihwh.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China_paper.pdf&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\fNXCtU.tmp C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\system32\findstr.exe
      findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
      4⤵
      PID:2644
  - - \??\c:\windows\system32\certutil.exe
      c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
      4⤵
      PID:2684
  - - C:\Windows\system32\expand.exe
      expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\
      4⤵
      Drops file in Windows directory
      PID:2712
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\China_paper.pdf"
      4⤵
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1968
  - - C:\Users\Admin\AppData\Roaming\pfexec.exe
      C:\Users\Admin\AppData\Roaming\pfexec.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 c0164b1ae0a6d511b8915c5ecf8bd864dcd68c4480def087ea1d46af820927a4
MD5 abe858f963b17ec8300ab198e98cf499
SHA1 8230d38bbac004cc591bc1931c0e64bebf106ab7
SHA512 65c10f165cb88f14c8cfec47517dc742b8aee358e63d1b99b9c2dcc56ed18d804fdcdd0eb98d1a322c098166b202d5554e023718cd22c66d6d4a3aa2844e557a
MD5 SHA1 SHA512

Submit Download

China_paper.pdf

Path C:\Users\Admin\AppData\Roaming\China_paper.pdf
Size 134KB
SHA256 aa880c609f5cbac2b45977359d1fd87f8292bc23e262c7a71530ae28948bdb49
MD5 cf36324614bf0c7d2650ea0e25506aaf
SHA1 f7c36d63cdc4f7467ae20b03f358c0f4ad602814
SHA512 bc86ce76d7c89c97f920cd5411b9471b1f6a95806e6a9baa86e25fe73e12ff8a46b12976877bee337dd1577b67a224d229be3adda3385407fc1001756783b293
SSDEEP 3072:M6EODLaxuwkwfcC/wGASrvn+Pbi+cdnACQQhBWIZ:hEqIuQcC/wtjRCQwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fNXCtU.tmp

Path C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
Size 1.7MB
SHA256 86fb58a2602b89426b256b371a7453d3b9895e34ce23890f266802dc65e80c47
MD5 a0e8cacc2103ef81705680b7b7a96997
SHA1 37b8c24121aff2a817980648b0a29a9a2f4b3bdf
SHA512 519431ef7d14b0489ea2b25b404f86872f2c4a286d843ebb2a36cec9d7a1e61e2a1e6884c193bed040dfd0640531093b3e6f5b6009fd16493a77ff271edb5e6b
SSDEEP 24576:BE4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdk9:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwlcnx.tmp

Path \??\c:\users\admin\appdata\roaming\dwlcnx.tmp
Size 847KB
SHA256 a19b88046b9ecd462037c7eef4cda1407664a1010ee0c8ef2b2fc907a129f6b7
MD5 d9ef25b85633b5754cfafadda6a2a4b7
SHA1 d58f9a3ef6c120bd2f2e352e184afa438f0d74f7
SHA512 1ee72b19712cb19046cc14ccc9c7abd643d104a3cb4cd562d58e35bf380e5f80b8ba4b80ee5e559fe56fa1031dc3cf9bba3242bc5fed584d3d6111c4eb81920c
SSDEEP 24576:8VGS8hcWOZ0sjeSnnTXReP8OD+yF0ogvKV3LW9YmR:8VYhcXKyemXQF+yFv8ai9YS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2932-82-0x00000000000F0000-0x0000000000124000-memory.dmp

Download

memory/2932-83-0x00000000002B0000-0x0000000000338000-memory.dmp

Download

memory/2932-84-0x00000000002B0000-0x0000000000338000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads