cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__MACOS/_params.cat.js
Size 1.4MB
Sample240719-ppn5ba1dpn
SHA256 32dda71e75546bed9c3032a139fb1ef8d1b05e35f26bccb568cebbae76db7f01
MD5 5acef2454ed89c4ea4453b5110e88023
SHA1 704729e91c09bf8c9ece3d477af1a9f7bb1f4744
SHA512 c7db5cea6dc13467beece885b52e5803f0147359e4522e355b270af7a8fd23a63d0033380ecdce871051ab1a3d9087b74cccfdfc044db60fe40e411e6ad3398a
SSDEEP 24576:NfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5X9:9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2160	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
2160	pfexec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4928	WINWORD.EXE
4928	WINWORD.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE
4928	WINWORD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 656	1584	wscript.exe	84
PID 1584 wrote to memory of 656	1584	wscript.exe	84
PID 656 wrote to memory of 1224	656	cmd.exe	86
PID 656 wrote to memory of 1224	656	cmd.exe	86
PID 656 wrote to memory of 3144	656	cmd.exe	87
PID 656 wrote to memory of 3144	656	cmd.exe	87
PID 656 wrote to memory of 1608	656	cmd.exe	88
PID 656 wrote to memory of 1608	656	cmd.exe	88
PID 656 wrote to memory of 4928	656	cmd.exe	90
PID 656 wrote to memory of 4928	656	cmd.exe	90
PID 656 wrote to memory of 2160	656	cmd.exe	93
PID 656 wrote to memory of 2160	656	cmd.exe	93
PID 656 wrote to memory of 2160	656	cmd.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\__MACOS\_params.cat.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp > C:\Users\Admin\AppData\Roaming\wnMKDE.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\gmhqKH.tmp C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\findstr.exe
    findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
    3⤵
    PID:1224
- - \??\c:\windows\system32\certutil.exe
    c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
    3⤵
    PID:3144
- - C:\Windows\system32\expand.exe
    expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\
    3⤵
    - Drops file in Windows directory
    PID:1608
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4928
- - C:\Users\Admin\AppData\Roaming\pfexec.exe
    C:\Users\Admin\AppData\Roaming\pfexec.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDD231.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5 SHA1 SHA512 SSDEEP

Submit Download

China's_gray_zone_warfare_against_Taiwan.doc

Path C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc
Size 75KB
SHA256 156eec85df18e7ff992a5bf35c97938557ac506c2306a8cb6633602d8a6568ed
MD5 16578aeab36f8c8f72d1a858ec21fd9c
SHA1 78f2d46da970d00033a483d0098ba9e106694321
SHA512 7e5171f365ea40e095dc6431a7598baeca21b46a52ca53a56e8124c4b41b6f3fd6f8f2afc0cf4db6b30da5a71e72a3451c53074681ed0cc5893db4fbf8f6a6e9
SSDEEP 768:Ltwiwp2CLsNgrnt7GcQ3/JGk8oBX3WJ3mF0z3wrtwcFwDdxz99:LtNCINmGcQ3Rh8+X3WJWF0z3wqcSDd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 365B
SHA256 eac9a3eb35969a4490ea35b426d5703b1e6a44cd2011f665ef3872ee9f4e5114
MD5 8568ce3ae36484f10808288701ecd6c6
SHA1 7ccdb6ab4fd75a89f1d3e2fceefb83261dde1535
SHA512 1f23e3f47d6a2bb58466b778415270b4c7c20177ac3af2a1aa0deaedf81f6a719c24d628fe94cba86e12b9297fe42ae7d64cb1f9df2f9174d3c964ed254a93d1
MD5 SHA1 SHA512

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 61360019104eba0931d053327b19ae55ef797c0f947554c93fa77c30ca222c81
MD5 0bd6aa060d47a01ad36d336237cda274
SHA1 66c52992a48f1f84b707491e7b69c50e319e6ea7
SHA512 cd8ca9927ee5d12ba3c404075af4dedecbe040488a55cebc1c4aa8ce485aea6588d802126c5c3c65f64c8a68423baf3c23ce038ad21aab66d490b1ab9760a4d6
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 671B
SHA256 2f1eef8f0a07a0361a048dbd68224b84eb149915a964864ef903f4b0463b38f8
MD5 60119828a54a665b03cd2b273871966a
SHA1 f3b0e618655bfcc6e132ab7453cfe2b6b53b5c8a
SHA512 b83a44861aeba43759cd274790f10e178bf436a2886720738a1722c7d4b7fa26c52e2db5e77651010b899fb636cde6aa2a21582d8a59689d866a8278353b5e26
MD5 SHA1 SHA512

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmhqKH.tmp

Path C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
Size 1.4MB
SHA256 9afb6689a659f6b963d5273bab3bc7bddde88d8a00f5ee12eebffe1926b650c8
MD5 05d9845ccaa230a1f69c75b4ef0e74e3
SHA1 b0acfc3e20e14c6d444e879a6a3e54bff72df005
SHA512 0ddaa8676b788f7ac79a477bf4707ea05207a12fa4b37f3898bef4f624ceea45cd16b1bd5b29ec9de9274814725cebb793feb63551d8a62b8172efd8d6595b5c
SSDEEP 24576:bfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5Xc:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuhswb.tmp

Path \??\c:\users\admin\appdata\roaming\yuhswb.tmp
Size 741KB
SHA256 2fe53a6d753eb0e288b0e514b5668ed13749227da65cd346c144c0cf8e438974
MD5 2f9c9af52d5a3c25363bb288fa997f21
SHA1 0d1a1bf7f13f16ba38fe96cbf22f06b0e38edf19
SHA512 a8e6cc507d9d6a2477b153dc2ebac284b4125ca9ee54d7484cf9bb5b36393b2747681b30b53d5a4fe47d152a23f60a50de72a1a313048cf90dd21a4ddc591924
SSDEEP 12288:lh5vSW+hDwS8Nn0NlpDnBHauPOBmIOAxcvWIpnMbhuDlWpHIqMRKbet:lLGUSyn09tHauPOQXAxcuIlMbh4WFIqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2160-51-0x0000000001770000-0x00000000017F8000-memory.dmp

Download

memory/2160-49-0x00000000012A0000-0x00000000012D4000-memory.dmp

Download

memory/2160-50-0x0000000001770000-0x00000000017F8000-memory.dmp

Download

memory/4928-578-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-21-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-23-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-20-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-27-0x00007FFD0C8C0000-0x00007FFD0C8D0000-memory.dmp

Download

memory/4928-28-0x00007FFD0C8C0000-0x00007FFD0C8D0000-memory.dmp

Download

memory/4928-22-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-579-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-580-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-24-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

memory/4928-581-0x00007FFD0EB10000-0x00007FFD0EB20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads