The Information provided at the time of posting was detected as “Cobalt Strike”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security

TimeStamp 2021-11-11T10:57:59.748061

Cobalt Strike
Cobalt Strike

General Information

624077963
Cloud Provider
Cloud Region
Service
Domainsdnsme[.]in
Hostnamesnl[.]dnsme[.]in
HTTP Host185[.]162[.]235[.]61
ISPServerius B.V.
ORGAlliance LLC
OSN/A
HTTPN/A
HTTP HTML HASHN/A
HTTP LOCATION/
HTTP REDIRECTS
HTTP ROBOTSN/A
HTTP ROBOTS HASHN/A
HTTP SECURITY.TXTN/A
HTTP SECURITY.TXT HASHN/A
HTTP SERVERnginx
HTTP SITEMAPN/A
HTTP SITEMAP HASHN/A
HTTP TITLEN/A
LOCATION (AREA CODE)N/A
LOCATION (CITY)Amsterdam
LOCATION (COUNTRY CODE)NL
LOCATION (COUNTRY NAME)Netherlands
LOCATION (LATITUDE)52.37403
LOCATION (LONGITUDE)4.88969
LOCATION (POSTAL CODE)N/A
SSL SERIAL
SSL EXPIREDN/A
SSL FINGERPRINT (SHA1)def936bc3a34bd9257c5e04aef032da9fdccd857
SSL ISSUED20211101192605Z
SSL EXPIRES20221101192605Z
SSL CYPHERECDHE-RSA-AES256-GCM-SHA384
SSL VERSIONTLSv1/SSLv3
SSL TRUST (REVOKED)N/A
TAGSself-signed


Cobalt Strike Beacon Information

Beacon TypeHTTPS
http-get.clientUser-Agent: Microsoft-CryptoAPI /10[.]0, Content-Type: application/ocsp-request
http-post.clientUser-Agent: Microsoft-CryptoAPI /10[.]0, Content-Type: application/ocsp-request, Etag
DNS Beacon MaxDNSN/A
DNS Beacon IdleN/A
Beacon Jitter35
dns-beacon.strategy_fail_seconds-1
dns-beacon.strategy_rotate_seconds-1
dns-beacon.strategy_fail_xN/A
HTTP GET URI185[.]162[.]235[.]61,/MQEw
HTTP POST URI/ocsp4
Max GET Size1048580
Port443
post-ex.spawnto_x64%windir%\sysnative\svchost[.]exe
post-ex.spawnto_x86%windir%\syswow64\svchost[.]exe
process-inject.startrwx64
process-inject.userwx32
process-inject.allocatorN/A
proxy.behavior2 (Use IE settings)
sleeptime45000
useragent_headerMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)
uses_cookiesN/A
process-inject.executeCreateThread, SetThreadContext, CreateRemoteThread, RtlCreateUserThread
Watermark1294832939
Beacon Stage Cleanup1