cobaltstrike | 27d2c327bfb0c80b3dcab3d4f0b5936b255d154a90daf4e30103f06e9e02a11c

General

Target

stage1.ps1
Size

273KB
MD5

28dbf3a6ff7964702507548699a38a1e
SHA1

ba904a5ce761598cf6b0538c4c87a8262458322e
SHA256

27d2c327bfb0c80b3dcab3d4f0b5936b255d154a90daf4e30103f06e9e02a11c
SHA512

374eff6c2c4abcdff6bcadc129b91d6b17337d21d21a373aab25c1caf09abab58a7637fb8d3ca3ffd1b4bdd47888fd68e61713fd077544f641d193597a2fa901

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

7 1812 powershell.exe
8 1812 powershell.exe
9 1812 powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

1068 powershell.exe
1812 powershell.exe
1812 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1068 powershell.exe
Token: SeDebugPrivilege 1812 powershell.exe

flow	pid	process
7	1812	powershell.exe
8	1812	powershell.exe
9	1812	powershell.exe

pid	process
1068	powershell.exe
1812	powershell.exe
1812	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1068 wrote to memory of 1812	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 1812	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 1812	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 1812	1068	powershell.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\stage1.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-29-0x000007FEF6500000-0x000007FEF677A000-memory.dmp

Filesize
2.5MB

Download
memory/1068-10-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1068-9-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1068-5-0x000000001AD90000-0x000000001AD91000-memory.dmp

Filesize
4KB

Download
memory/1068-6-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/1068-11-0x000000001B740000-0x000000001B741000-memory.dmp

Filesize
4KB

Download
memory/1068-8-0x000000001AD14000-0x000000001AD16000-memory.dmp

Filesize
8KB

Download
memory/1068-4-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1068-3-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Filesize
9.9MB

Download
memory/1068-7-0x000000001AD10000-0x000000001AD12000-memory.dmp

Filesize
8KB

Download
memory/1068-12-0x000000001C2D0000-0x000000001C2D1000-memory.dmp

Filesize
4KB

Download
memory/1068-13-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/1068-33-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1068-32-0x000000001B7D0000-0x000000001B7D1000-memory.dmp

Filesize
4KB

Download
memory/1068-31-0x000000001C420000-0x000000001C421000-memory.dmp

Filesize
4KB

Download
memory/1068-30-0x000000001ABA0000-0x000000001ABA1000-memory.dmp

Filesize
4KB

Download
memory/1068-2-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmp

Filesize
8KB

Download
memory/1812-18-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/1812-20-0x0000000002832000-0x0000000002833000-memory.dmp

Filesize
4KB

Download
memory/1812-21-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1812-22-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/1812-23-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/1812-24-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1812-25-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/1812-26-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/1812-27-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/1812-28-0x0000000005CB0000-0x0000000005CE3000-memory.dmp

Filesize
204KB

Download
memory/1812-19-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1812-17-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/1812-16-0x0000000073510000-0x0000000073BFE000-memory.dmp

Filesize
6.9MB

Download
memory/1812-15-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1812-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads