cobaltstrike | eb0349ee317c0e608391acdde170ae7564f5f1dae1ea6a717de14fe7a8a8d63a

Analysis

max time kernel
104s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2025, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Size

4.7MB
MD5

a1113a22163c4b10d1af64da9bcd2567
SHA1

10853fb68c951a4ecf51b84b22fbcfe3beedad66
SHA256

eb0349ee317c0e608391acdde170ae7564f5f1dae1ea6a717de14fe7a8a8d63a
SHA512

ea5b1006515df6087652162f7113ec7a1e5ae9fa4de7de494d6b0623dfd1614e42644290d2fa5527f7cbf13f7a8c8368cfea811f7274b955c4bf589b279e95f9
SSDEEP

98304:nVidQWbsgvS6gpSTWmjlKjAyljgkuF1fqL1enHzb/UQ:ViXbrS6gIWoKFGkkiL0AQ

Score

10^/10

cobaltstrike xmrig backdoor miner trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00070000000242b9-6.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/5504-698-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-696-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-1685-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-2852-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-4055-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-5058-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-5065-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-5066-0x0000000000401000-0x00000000010B5000-memory.dmp	xmrig
behavioral1/memory/5504-5067-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/5504-5068-0x0000000000401000-0x00000000010B5000-memory.dmp	xmrig

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\$Recycle.Bin\S-1-5-21-446031748-3036493239-2009529691-1000\desktop.ini	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
55	raw.githubusercontent.com
77	bitbucket.org
79	bitbucket.org

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	F:\autorun.inf	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	F:\autorun.inf	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5504-0-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/files/0x00070000000242b9-6.dat	upx
behavioral1/memory/5504-698-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-696-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-1685-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-2852-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-4055-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-5058-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-5065-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/5504-5067-0x0000000000400000-0x00000000010B6000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-100.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-white_scale-125.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-200.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\10.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\PaintLargeTile.scale-150.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnetwk.exe.mui	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-black.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.INF	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSplash.scale-100_contrast-white.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxSignature.p7x	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.INF	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-150_contrast-black.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\TrackingDLL.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODATA.DLL	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\SmallTile.scale-125.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dcpr.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO40UIRES.DLL	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-446031748-3036493239-2009529691-1000-MergedResources-0.pri	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\View3d\3DViewerProductDescription-universal.xml	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\mfcm140u.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.scale-125.png	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe

Modifies Internet Explorer start page 1 TTPs 3 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.qoOhMDCNCe.com"	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.nsEMRdPaZL.com"	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.JlywnwdUjj.com"	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe

Modifies system certificate store 2 TTPs 9 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5504	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
Token: SeLockMemoryPrivilege	5504	2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-07_a1113a22163c4b10d1af64da9bcd2567_amadey_cobalt-strike_cobaltstrike_smoke-loader.exe"
1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:5504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\8d19d0e8d5fcbfdcd3d915bf7314\2010_x86.log.html.exe

Filesize
5.0MB

MD5
f9f268f9c6d1d645d166ae2112def523

SHA1
80f42ef68f6fe247892f2a500566b15b0e655dbb

SHA256
c16f5ca33cab25c89ceecc435b22de7a17fa6a47830e5fb67afa42e3be4c754e

SHA512
1a2266c5f076865ef911911cc0996a22ed827e37dd2cc7c60a678cbe9c293e803e155483137ae82aaf9c707183dcffa0d7c992f8f395d01d556c65510e4b005a

Download Submit
memory/5504-2852-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-1-0x00000000017A0000-0x00000000017B0000-memory.dmp

Filesize
64KB

Download
memory/5504-698-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-696-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-1685-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-0-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-4055-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-5058-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-5061-0x0000000000060000-0x0000000000062000-memory.dmp

Filesize
8KB

Download
memory/5504-5065-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-5066-0x0000000000401000-0x00000000010B5000-memory.dmp

Filesize
12.7MB

Download
memory/5504-5067-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/5504-5068-0x0000000000401000-0x00000000010B5000-memory.dmp

Filesize
12.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads