cobaltstrike | ac791befcd13c94d81a51d57f3f9d8cefbe554a2e0b24f3cb0704cfb4b215a1a

General

Target
Q3_2026081017001/Q3_2026081017001.lnk
Size 618B
Sample260814-ewxd6avshv
SHA256 ac791befcd13c94d81a51d57f3f9d8cefbe554a2e0b24f3cb0704cfb4b215a1a
MD5 a2f6c36bd658552d20fa8c229b5d1922
SHA1 4be20007738fe61a0cf438fa72187cf09f59bfa4
SHA512 fbed06f805c83cb1d49fff562d59483241701a35dfd08d776d6bf0c3f0c0be5e0e7ab3b563b85df2baec89df2b9fa3bdf49f6d6bceb8a058f55c83f48d538f29
TLSH
T18AF0ED2CAEC71B3AD640C235EC776300C93A38A6F6A50F6E40844B8410B72012688E2F
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor 391144938 discovery execution cobaltstrike trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

C2

http://osce12-0-sc.url.asiainfo-sec.com:443/dist/css/bootstrap.min.css

Attributes

access_type
512
beacon_type
2048
host
osce12-0-sc.url.asiainfo-sec.com,/dist/css/bootstrap.min.css
http_header1
AAAACgAAADhBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sOwAAABAAAAAWSG9zdDogZ2V0Ym9vdHN0cmFwLmNvbQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC45AAAABwAAAAAAAAANAAAAAgAAAAlfX2NmZHVpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAADhBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sOwAAABAAAAAWSG9zdDogZ2V0Ym9vdHN0cmFwLmNvbQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAACgAAAB9BY2NlcHQtTGFuZ3VhZ2U6IHpoLUNOLHpoO3E9MC45AAAABwAAAAAAAAANAAAABQAAAAVzZXJ2ZQAAAAcAAAABAAAAAwAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
POST
http_method2
POST
jitter
9472
polling_time
10000
port_number
443
sc_process32
%windir%\syswow64\svchost.exe -k netsvcs
sc_process64
%windir%\sysnative\svchost.exe -k netsvcs
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYHK/0x3rcyqtMXnhlsxXiY2vZpm/QWLhUNR7hXkdeBmQnOqRYB7coUvHbr87d1p4RJ1d+KsoEyXPOKduJTvguqUJ08u0uNvYf2PXFvYYfyunDj+Apci0yEnIklW2BCYY2BYhCh5i53iFFW26qthTzrgYcfpx/pJbU0DpK3dK4AQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
3.462927616e+09
unknown2
AAAABAAAAAEAAAAtAAAAAQAABsMAAAACAAAAFAAAAAIAAAA1AAAAAgAAACwAAAACAAAAJAAAAAIAAABLAAAAAgAAC6IAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/dist/js/bootstrap.bundle.min.js
user_agent
Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+
watermark
391144938

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5420	powershell.exe
4	5420	powershell.exe
10	5420	powershell.exe
11	5420	powershell.exe
12	5420	powershell.exe
13	5420	powershell.exe
14	5420	powershell.exe
15	5420	powershell.exe
16	5420	powershell.exe
17	5420	powershell.exe
18	5420	powershell.exe
19	5420	powershell.exe
20	5420	powershell.exe
21	5420	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5420	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	node.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5420	powershell.exe
5420	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5420	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4332	helper.exe
4332	helper.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4332	helper.exe
4332	helper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5100	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5092	1812	cmd.exe	90
PID 5100 wrote to memory of 4332	5100	explorer.exe	92
PID 4332 wrote to memory of 1380	4332	helper.exe	93
PID 1380 wrote to memory of 5420	1380	node.exe	95

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Q3_2026081017001\Q3_2026081017001.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1812
- C:\WINDOWS\explorer.exe
  "C:\WINDOWS\explorer.exe" helper\helper.exe
  2⤵
  PID:5092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\Q3_2026081017001\helper\helper.exe
  "C:\Users\Admin\AppData\Local\Temp\Q3_2026081017001\helper\helper.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Q3_2026081017001\helper\node.exe
    node.exe helper.js
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -NonInteractive
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5420