#COBALT STRIKE WATERMARK INSTALL#
#COBALT STRIKE WATERMARK WINDOWS#

We offer multiple services including a Threat Feed service which tracks Command and Control frameworks such as Cobalt Strike, BazarLoader, Covenant, Metasploit, Empire, PoshC2, etc. This time the execution worked as intended and resulted in domain wide ransomware. Finally, twenty minutes after accessing the domain controllers, the threat actors dropped the ransomware DLL and the batch script and executed it from the domain controller. While these exploits appear to have failed the threat actors found their previously captured domain admin credentials and launched two new Cobalt Strike beacons on the domain controllers. The threat actors had already secured domain admin access but it’s possible the operator may have thought they lacked permissions when their first ransomware execution failed. They left for a few hours, and then returned, and attempted to exploit a couple of CVE’s in an attempt to escalate privileges. However, they found that their execution failed. They then dropped their final ransomware payload on the beachhead host and attempted to execute it using a batch file named backup.bat. They reviewed the directory structure of several hosts including domain controllers and backup servers. On the 19th day, the threat actors moved towards their final objectives. A little discovery check-in was observed on the 14th day, but little else. On the tenth day, little activity was observed but the threat actors connected to the beachhead host via the Atera agent and executed another Cobalt Strike DLL. On day nine of the intrusion, the next Cobalt Strike server, which would ultimately be used until the end of the intrusion, was observed for the first time. After this, the threat actors went quiet. From the domain controller, the threat actors proceeded with more discovery tasks including AdFind and Invoke-ShareFinder again. From the beachhead host, a DLL was transferred to a domain controller over SMB and then a remote service was created on the domain controller to execute the Cobalt Strike DLL.Īfter getting a foothold on the domain controller, we saw more process injection followed by the same pattern of installing Atera for additional persistent access. On that day, a new Cobalt Strike server was observed, in fact over the course of the intrusion, four different Cobalt Strike servers were used. On the following day, the seventh day of the intrusion, the threat actors made their next move. On the sixth day of the intrusion, the beachhead host saw new discovery activity with a quick nltest followed by the PowerView script Invoke-ShareFinder. Soon after, one of the injected Cobalt Strike processes accessed LSASS memory to dump credentials from the beachhead. In this intrusion, we observed usage of gmailcom and outlookcom email accounts for Atera agent registration. Use of these 3rd party administrative tools allow the threat actors another “legitimate” means of persistence and access if they were to lose their malware connection.

#COBALT STRIKE WATERMARK INSTALL#

The threat actors proceeded to install remote management tools such as Atera Agent and Splashtop. Process injection into explorer.exe was then observed from the Cobalt Strike Beacon. Nltest and net group were utilized to look for sensitive groups such as Domain Admins and Enterprise Admins.

#COBALT STRIKE WATERMARK WINDOWS#

Soon after, another round of discovery was performed from the Cobalt Strike beacon focusing on the Windows domain. The IcedID malware then used Windows utilities such as net, chcp, nltest, and wmic, to perform discovery activity on the host.Īfter a gap of almost an hour, a Cobalt Strike beacon was dropped and executed on the beachhead host. The task executed the IcedID payload every one 1 hour. This was followed by the creation of a scheduled task on the beachhead host to establish persistence. Upon execution of the IcedID DLL, a connection to a C2 server was established. This was first reported by Microsoft in April 2021. We assess with high confidence that the “ Stolen Image Evidence” email campaign was used to deliver the IcedID DLL. While remaining dormant most of the time, the adversary deployed Conti ransomware on the 19th day (shortly after Christmas), resulting in domain wide encryption. Along the way, the threat actors installed remote management tools such as Atera and Splashtop for persisting in the environment. Upon execution of the IcedID DLL, discovery activity was performed which was followed by the dropping of a Cobalt Strike beacon on the infected host. IcedID is a banking trojan that first appeared in 2017, usually, it is delivered via malspam campaigns and has been widely used as an initial access vector in multiple ransomware intrusions. In this intrusion from December 2021, the threat actors utilized IcedID as the initial access vector.

Cobalt strike watermark