cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
139s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__MACOS/_params.cat.js
Size 1.4MB
Sample240719-ppn5ba1dpn
SHA256 32dda71e75546bed9c3032a139fb1ef8d1b05e35f26bccb568cebbae76db7f01
MD5 5acef2454ed89c4ea4453b5110e88023
SHA1 704729e91c09bf8c9ece3d477af1a9f7bb1f4744
SHA512 c7db5cea6dc13467beece885b52e5803f0147359e4522e355b270af7a8fd23a63d0033380ecdce871051ab1a3d9087b74cccfdfc044db60fe40e411e6ad3398a
SSDEEP 24576:NfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5X9:9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 1 IoCs

pid	Process
3028	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
3028	pfexec.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2944	WINWORD.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
2944	WINWORD.EXE
3028	pfexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2944	WINWORD.EXE
2944	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2448	1300	wscript.exe	30
PID 1300 wrote to memory of 2448	1300	wscript.exe	30
PID 1300 wrote to memory of 2448	1300	wscript.exe	30
PID 2448 wrote to memory of 328	2448	cmd.exe	32
PID 2448 wrote to memory of 328	2448	cmd.exe	32
PID 2448 wrote to memory of 328	2448	cmd.exe	32
PID 2448 wrote to memory of 2948	2448	cmd.exe	33
PID 2448 wrote to memory of 2948	2448	cmd.exe	33
PID 2448 wrote to memory of 2948	2448	cmd.exe	33
PID 2448 wrote to memory of 2376	2448	cmd.exe	34
PID 2448 wrote to memory of 2376	2448	cmd.exe	34
PID 2448 wrote to memory of 2376	2448	cmd.exe	34
PID 2448 wrote to memory of 2944	2448	cmd.exe	35
PID 2448 wrote to memory of 2944	2448	cmd.exe	35
PID 2448 wrote to memory of 2944	2448	cmd.exe	35
PID 2448 wrote to memory of 2944	2448	cmd.exe	35
PID 2448 wrote to memory of 3028	2448	cmd.exe	36
PID 2448 wrote to memory of 3028	2448	cmd.exe	36
PID 2448 wrote to memory of 3028	2448	cmd.exe	36
PID 2448 wrote to memory of 3028	2448	cmd.exe	36
PID 2944 wrote to memory of 2040	2944	WINWORD.EXE	37
PID 2944 wrote to memory of 2040	2944	WINWORD.EXE	37
PID 2944 wrote to memory of 2040	2944	WINWORD.EXE	37
PID 2944 wrote to memory of 2040	2944	WINWORD.EXE	37

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\__MACOS\_params.cat.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp > C:\Users\Admin\AppData\Roaming\wnMKDE.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\gmhqKH.tmp C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\findstr.exe
    findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
    3⤵
    PID:328
- - \??\c:\windows\system32\certutil.exe
    c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
    3⤵
    PID:2948
- - C:\Windows\system32\expand.exe
    expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\
    3⤵
    - Drops file in Windows directory
    PID:2376
- - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:2040
- - C:\Users\Admin\AppData\Roaming\pfexec.exe
    C:\Users\Admin\AppData\Roaming\pfexec.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

China's_gray_zone_warfare_against_Taiwan.doc

Path C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc
Size 75KB
SHA256 156eec85df18e7ff992a5bf35c97938557ac506c2306a8cb6633602d8a6568ed
MD5 16578aeab36f8c8f72d1a858ec21fd9c
SHA1 78f2d46da970d00033a483d0098ba9e106694321
SHA512 7e5171f365ea40e095dc6431a7598baeca21b46a52ca53a56e8124c4b41b6f3fd6f8f2afc0cf4db6b30da5a71e72a3451c53074681ed0cc5893db4fbf8f6a6e9
SSDEEP 768:Ltwiwp2CLsNgrnt7GcQ3/JGk8oBX3WJ3mF0z3wrtwcFwDdxz99:LtNCINmGcQ3Rh8+X3WJWF0z3wqcSDd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 19KB
SHA256 a1c54f7daa1a5ee2575fc16f8edd7d5f46de5a650f026aea536243efc86f9f9a
MD5 5c11d4642315cf054cfb386563c32eb3
SHA1 05bbd95967ec723da6e0b4fef45b329f75fc8bd2
SHA512 4b7437f62f5adbf42ef8139415303fca7fe2895fe463987151869b1f93625a4f3a6193c5b210c4827a74a5c1985ee903f81ebb4f23b18fc3b03c8c442135d9b6
SSDEEP 384:Pjl/SU5bGRqfV+LhLWG6F7//ooOoVLrR9Ke/AMaqs4GSJ8XMAPCb:pGY2IRFTP/s2AS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmhqKH.tmp

Path C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
Size 1.4MB
SHA256 9afb6689a659f6b963d5273bab3bc7bddde88d8a00f5ee12eebffe1926b650c8
MD5 05d9845ccaa230a1f69c75b4ef0e74e3
SHA1 b0acfc3e20e14c6d444e879a6a3e54bff72df005
SHA512 0ddaa8676b788f7ac79a477bf4707ea05207a12fa4b37f3898bef4f624ceea45cd16b1bd5b29ec9de9274814725cebb793feb63551d8a62b8172efd8d6595b5c
SSDEEP 24576:bfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5Xc:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuhswb.tmp

Path \??\c:\users\admin\appdata\roaming\yuhswb.tmp
Size 741KB
SHA256 2fe53a6d753eb0e288b0e514b5668ed13749227da65cd346c144c0cf8e438974
MD5 2f9c9af52d5a3c25363bb288fa997f21
SHA1 0d1a1bf7f13f16ba38fe96cbf22f06b0e38edf19
SHA512 a8e6cc507d9d6a2477b153dc2ebac284b4125ca9ee54d7484cf9bb5b36393b2747681b30b53d5a4fe47d152a23f60a50de72a1a313048cf90dd21a4ddc591924
SSDEEP 12288:lh5vSW+hDwS8Nn0NlpDnBHauPOBmIOAxcvWIpnMbhuDlWpHIqMRKbet:lLGUSyn09tHauPOQXAxcuIlMbh4WFIqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2944-42-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2944-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/3028-58-0x0000000000080000-0x00000000000B4000-memory.dmp

Download

memory/3028-59-0x00000000004E0000-0x0000000000568000-memory.dmp

Download

memory/3028-66-0x00000000004E0000-0x0000000000568000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads