COBALT STRIKE BEACON MULTIPLE HOSTS INSTALL

To guarantee execution on the beachhead host, multiple payloads were used. As part of further automated tasking, Trickbot performed an initial reconnaissance of the environment using native Windows tools such as nltest.exe and net.exe.įirst hands-on activity was observed two hours after initial compromise, when Trickbot downloaded and executed Cobalt Strike Beacons. Trickbot was automatically tasked to inject into the wermgr.exe process and use its well-known “pwgrab” module to steal browser credentials. Certutil was used to download and load the Trickbot DLL into memory.

Upon execution, certutil.exe was copied to %programdata% and renamed with random alphanumeric characters.

The Trickbot payload came from a phishing campaign associated with BazarCall, delivering weaponized XLSB files. We have observed the same techniques in other intrusions and understanding these techniques will allow defenders to disrupt such intrusion activity and deny it in their own networks. Even though most of the techniques aren’t new or advanced, they have proven to be effective. The Conti operators chose to wait a couple days before ransoming the environment. The threat actors were able to go from initial access to the deployment of Conti ransomware in a matter of hours. In this intrusion, we observed a number of interesting techniques being leveraged by the threat actors. Unfamiliar with BazaCall/BazarCall? Read more here from & and here from & Summary A couple days later, the threat actors came back and executed Conti ransomware across the domain. From there the threat actor discovered the internal network before moving laterally to a domain controller for additional discovery.

COBALT STRIKE BEACON MULTIPLE HOSTS INSTALL

The threat actors used BazarCall to install Trickbot in the environment which downloaded and executed a Cobalt Strike Beacon. This report will go through an intrusion that went from an Excel file to domain wide ransomware.

Cobalt strike beacon multiple hosts