cyber.hendryadrian.com
Threat Research · huntress.com

Huntress Traces Obfuscated Cobalt Strike Malware Across 662 Registry Values

· Original article ↗

Summary

Huntress analysts traced Cobalt Strike malware from a suspicious RunOnce key through obfuscated PowerShell and five in-memory binaries, detailing registry-based staging, process injection, evasion tactics and beacon behavior.

Key points

  • A suspicious RunOnce entry launched hidden PowerShell that retrieved a command from a user environment variable.
  • The script assembled and decoded payload data stored across 662 registry values, then loaded a .NET DLL into memory.
  • Analysis uncovered a chain of five binaries, including malware targeting the legitimate Werfault.exe process for injection.
  • The malware used sleep delays, obfuscation, runtime API resolution, and dynamic memory operations that hindered automated and manual analysis.
  • A Cobalt Strike parser confirmed the malware; its configuration indicated HTTPS POST communications and included a C2 server IP.
  • The test system had no network access, so the beacon's connection attempts failed and any possible additional payload retrieval was not observed.

Article Details

Attack Vectors
  • A RunOnce registry entry launched a hidden PowerShell command that read payload data stored across registry values.
  • The PowerShell script de-obfuscated the registry data, converted it to bytes, and loaded a DLL into memory through reflection.
  • The malware reset RunOnce values to maintain persistence across reboots.
  • A later payload injected code into the legitimate Werfault.exe process.
  • The Cobalt Strike beacon used HTTPS POST requests for C2 communication and placed Malleable C2 data in HTTP cookie headers.
Defensive Notes
  • Do not rely solely on automated scanning; the article recommends a human analysis component for detecting obfuscated malware.
  • Investigate suspicious RunOnce entries and registry-stored data, including payloads spread across many registry values.
  • The analyzed malware used sleep delays to hinder automated scanning and dynamic analysis.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe payload was obfuscated across registry values and used substituted characters; the article also describes a Base64-encoded PowerShell command.T1055 · Process InjectionThe malware injected a payload into the Werfault.exe process.T1059.001 · PowerShellPowerShell commands retrieved and decoded registry-stored data, loaded a DLL, and executed its method.T1071.001 · Web ProtocolsThe Cobalt Strike beacon communicated with its C2 server using HTTPS POST requests.T1112 · Modify RegistryThe malware manipulated RunOnce registry values to support persistence across reboots.T1140 · Deobfuscate/Decode Files or InformationThe PowerShell script reconstructed and decoded the obfuscated registry data into bytes for loading as a DLL.T1497.003 · Time Based ChecksPayload components used 60-second and 10-second sleep delays, which the article says were intended to evade automated scanning and hinder dynamic analysis.T1547.001 · Registry Run Keys / Startup FolderThe malware used RunOnce registry values and reset them to maintain execution across reboots.T1564.003 · Hidden WindowThe initial PowerShell command launched with a hidden window.T1620 · Reflective Code LoadingPowerShell reflection loaded the reconstructed DLL into memory without writing the decoded payload to disk.

Products

Microsoft WindowsHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceThis key is used to automatically execute a program when a user logs into their machine. Since this is a “RunOnce” key, it will automatically be deleted once it hasPowerShellWe inspected the command in the suspicious key and found this, which seemed to be executing a PowerShell command stored in one user’s environment variables.

Tools

Cobalt StrikeLittle did we know, we were about to encounter Cobalt Strike malware hidden across almost 700 registry values and encased within multiple layers of fileless executables.Cobalt Strike ParserIn order to confirm that this was really Cobalt Strike malware, and to try and pull more information, we parsed the file using this Cobalt Strike Parser.dnSpySince the file was written in .NET, we were able to load it into dnSpy to analyze the source code. This is possible because .NET does not fully compile in the same way that C/C++ code does and instead “compiles” to anPE-bearAfter dumping the newly discovered section from the debugger, and re-aligning the sections using PE-bear, we were able to retrieve a fourth binary file: a 32-bit DLL, 315KB in size.x32dbgLoading up the file within the x32dbg debugger, we observed a large number of calls to the sleep function, which would cause the program to sleep 10 seconds between performing suspicious actions. This is yet another

Related Articles