cobaltstrike | ab823cbbde9ca87da1a0996c8c6f0f031811da5872d8271e6ae3232ca6276abe

Analysis

Target

sample.ps1
Size

273KB
MD5

e7df91ac5f161f54e3fafe18e92f528b
SHA1

b441934c695c87b462cc27dbce9910bfec8b7b61
SHA256

39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc
SHA512

6c3511be6abdcec26f22af4f5cdab818f00e9108802106874c6c8c25cf0d4a886ded1d0f17531535d60d15ef7f4bfb5e7c04dbe7599ca75abf7c7a846c3db091

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1096 powershell.exe
6 1096 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

828 powershell.exe
1096 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 828 powershell.exe
Token: SeDebugPrivilege 1096 powershell.exe

flow	pid	process
4	1096	powershell.exe
6	1096	powershell.exe

pid	process
828	powershell.exe
1096	powershell.exe

description	pid	process
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 828 wrote to memory of 1096	828	powershell.exe	powershell.exe
PID 828 wrote to memory of 1096	828	powershell.exe	powershell.exe
PID 828 wrote to memory of 1096	828	powershell.exe	powershell.exe
PID 828 wrote to memory of 1096	828	powershell.exe	powershell.exe

memory/828-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/828-56-0x00000000025C0000-0x00000000025C2000-memory.dmp

Filesize
8KB

Download
memory/828-57-0x00000000025C2000-0x00000000025C4000-memory.dmp

Filesize
8KB

Download
memory/828-58-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/828-55-0x000007FEF2D90000-0x000007FEF38ED000-memory.dmp

Filesize
11.4MB

Download
memory/828-59-0x00000000025CB000-0x00000000025EA000-memory.dmp

Filesize
124KB

Download
memory/1096-60-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1096-61-0x0000000002270000-0x0000000002EBA000-memory.dmp

Filesize
12.3MB

Download
memory/1096-62-0x00000000050E0000-0x0000000005113000-memory.dmp

Filesize
204KB

Download