Pikabot: The Multi-C2 Cobalt Strike Loader

Before you touch the data, get oriented. A workstation on the freight operations floor raised an endpoint alert this morning, and the early signs point to a loader infection that did not stop at itself.

The operations coordinator did not receive an attachment. They received a link, followed it, and pulled down an archive from an outside site. Recover the web address the archive was downloaded from.

The archive was advertised as transport paperwork, but what executed was not a document. Identify the file inside the archive that the endpoint actually ran.

The script did not carry the payload. It reached out and pulled a module down over an encrypted channel, then handed it to a trusted system utility to run. Recover the file that was staged and loaded.

Once the loader was running, it called home. Its command-and-control did not use a normal web port; it spread across several outside hosts on unusual high ports, which together are one channel. Recover the first endpoint it beaconed to, as address and port.

The loader did not stop at itself. It planted a second-stage implant inside a trusted Windows process and that implant reached out to a different command server over HTTPS. Recover the host the second-stage implant checked in to.

For the report, classify the evasion technique the attacker used to run the staged loader module through a signed system utility instead of launching it directly. Map it to its MITRE ATT&CK technique.