Overview

overview

10

Static

static

10

asdfgh.ps.ps1

windows7_x64

10

asdfgh.ps.ps1

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    26-11-2021 10:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    asdfgh.ps.ps1

  • Size

    193KB

  • MD5

    f9279a34baa5c3563096e9455a3e7be0

  • SHA1

    52556ead53f70cfa566cb735a3e31d2d2dfeea2c

  • SHA256

    6b58cfc97235c7e05efb6a826ae50614e3392caa778e9bfcb59056f36ae0e7b1

  • SHA512

    a9687b93ec56c7a5b85f874626bf9c86d6b942c7b30f9209f267fc036d8b155f66538e90f20e29b6634576af41fb3fcf668d967f0a4201a99078e7515d5fd54e

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Blocklisted process makes network request 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\asdfgh.ps.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • \??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
      "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1544
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x550
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1980
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1544-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1544-62-0x0000000075731000-0x0000000075733000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1544-64-0x00000000025F1000-0x00000000025F2000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1544-63-0x00000000025F0000-0x00000000025F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1544-65-0x00000000025F2000-0x00000000025F4000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1544-66-0x00000000050B0000-0x00000000050E3000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2032-55-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2032-57-0x0000000002640000-0x0000000002642000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2032-58-0x0000000002642000-0x0000000002644000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2032-59-0x0000000002644000-0x0000000002647000-memory.dmp
    Filesize

    12KB

    Download
  • memory/2032-56-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/2032-60-0x000000000264B000-0x000000000266A000-memory.dmp
    Filesize

    124KB

    Download