Huntress Traces Multi-Stage PowerShell Malware to a Cobalt Strike Beacon
Summary
Huntress analysts traced a phishing-delivered maldocx through PowerShell environment-variable persistence, encoded and encrypted scripts, and .NET/RunPE stages to a Cobalt Strike beacon running under Notepad.
Key points
- The reported infection path begins with a phishing-delivered maldocx and an executable; some variants use JavaScript and WScript before PowerShell.
- PowerShell establishes persistence in the user’s Run key and uses environment variables and registry values to retrieve further stages.
- The scripts use Base64 encoding, AES encryption, and compression, with repeated decoding and decryption stages.
- A payload downloaded from Discord was decoded into a .NET loader containing a further stage identified as RunPE.exe.
- The investigation describes API unhooking and a Notepad.exe process; Huntress identified the process as a Cobalt Strike beacon.
- The article reports C2 information at organitations[.]com/Preserve/stat/3E8YZFXJ and IP address 69.28.84.201.
- Huntress advises removing the beacon process and identifies additional user registry keys for cleanup.
Article Details
- Attack Vectors
- A phishing email delivers a maldocx; the reported execution chain includes JavaScript via Wscript, PowerShell, and a Cobalt Strike beacon.
- PowerShell uses environment-variable values and registry Run-key persistence to launch successive encoded and encrypted payload stages.
- A payload is downloaded from Discord, decoded, and used to launch subsequent stages, including a RunPE.exe payload associated with a Notepad.exe process.
- Defensive Notes
- Huntress recommends checking for PowerShell autoruns that call GetEnvironmentVariable and for 12–18-character hexadecimal values in the command line.
- Review HKU\SID\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKU\SID\Environment, and the associated HKU\SID\Software\<value> registry location; the article says the additional registry keys should be included in the customer report for removal.
- Investigate Notepad.exe spawned by PowerShell and remove the process identified in the article as a Cobalt Strike beacon.
- The article provides searches for PowerShell GetEnvironmentVariable activity, Notepad.exe with a PowerShell parent, and process cleartext containing cdn.discordapp.com and attachments.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 69[.]28[.]84[.]201 | IP address reported alongside the malware's C2 address. |
| URL | hxxps[:]//cdn[.]discordapp[.]com/attachments/1004902785772441697/1004915801771495495/ppp | Discord-hosted payload URL listed in the article's Discord URLs section. |
| URL | hxxps[:]//cdn[.]discordapp[.]com/attachments/1013559875034415135/1014369421629857882/sdwwcKkjnwsdw.mkv | Discord-hosted payload URL listed in the article's Discord URLs section. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe scripts use Base64-encoded variables and encrypted, compressed payload data.T1059.001 · PowerShellPowerShell runs encoded commands and scripts in the described infection chain.T1105 · Ingress Tool TransferThe analysis describes downloading a payload from a Discord link.T1140 · Deobfuscate/Decode Files or InformationThe payload stages are decoded and decrypted, including Base64 and AES processing.T1204.002 · Malicious FileThe user executes the file delivered through the phishing infection chain.T1547.001 · Registry Run Keys / Startup FolderThe malware establishes persistence in the user's Windows Run key.T1562.004 · Disable or Modify System FirewallThe article says the initial payload runs a command that disables the firewall.T1566.001 · Spearphishing AttachmentThe article describes an initial maldocx delivered through a phishing email.
People
Products
DiscordTo go further, it’s required to download the payload from a Discord link.Microsoft WindowsReviewing the Foothold Details, we are able to see the persistence created within the Hive Current Users Run Key. (HKU\SID\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)PowerShellFriday, September 30, 2022, seemed a day like any other--until a large amount of PowerShell malware came charging through seeking immediate attention. Sparing no time, I jumped right in.
Tools
Cobalt StrikeNote: It’s important to remove this process from the client as this is a cobalt strike beacon.CyberChefUsing Cyberchef, we can attempt to quickly decode the base64 strings with the formula of Subsection and Frombase64.dnSpyInspecting the netLoaderDll within dnSpy we see a few classes: Main, runPayload and StringToByteArray.PEStudioWith the decoded mkv_decoded.bin it’s important to still do a quick static analysis of the payload within pestudio.ResourceHackerAfter the execution of the RunPE.exe, we open ResourceHacker to see available processes on the host.x64dbgNow attach the Notepad.exe process to x64dbg and Go to Expression with Ctrl + G. Now paste the thread address 0x1da52c4acdf and set an execution breakpoint. We'll wait.