Cobalt Strike payloads: AES shellcode, XOR shellcode and C2 profile hints

by psyrun / 2022-03-23 / Framework

Cobalt Strike is a commercial post-exploitation toolkit that appears as the second stage of many infections. Common first-stage droppers include IcedID, ZLoader, Qakbot, Ursnif, Hancitor, Bazar and Trickbot. Beacons show up as MSIL, native EXE and DLL, and even Go builds.

Sample 1: document to AES shellcode

Word document
  -> fetches a template (.dotm) from a remote site, which drops two files in C:\ProgramData:
       Ecmd.exe   the loader
       Cf.ini     encrypted shellcode
  Ecmd.exe:
       1  checks the victim's country code, quits if it is RU or US
       2  reads Cf.ini into an array
       3  decrypts it with AES and converts to ASCII
       4  VirtualAlloc, copy, run on a new thread

The country check is a neat way to avoid analysis from the regions where many researchers sit.

Sample 2: XOR shellcode

Most Win32 and Win64 Cobalt Strike files decrypt their shellcode with a XOR loop. When you extract it, the shellcode starts with a small stub that XORs again to decrypt the server address and download the final beacon.

loader  XOR  -> stage-1 shellcode
stage 1 XOR  -> C2 address -> downloads the full beacon

Network hint

A very common tail on staging URLs is a path ending in /jquery-3.3.1.min.js, taken from the default malleable profile that imitates normal web traffic. Not unique, but a good pivot.

Notes

  • Check Public and ProgramData folders for an EXE next to an INI with high-entropy content.
  • Memory scanning for decrypted beacons is more reliable than reading each loader.