cobaltstrike | 39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc

Analysis

Target

39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc.ps1
Size

273KB
MD5

e7df91ac5f161f54e3fafe18e92f528b
SHA1

b441934c695c87b462cc27dbce9910bfec8b7b61
SHA256

39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc
SHA512

6c3511be6abdcec26f22af4f5cdab818f00e9108802106874c6c8c25cf0d4a886ded1d0f17531535d60d15ef7f4bfb5e7c04dbe7599ca75abf7c7a846c3db091

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

4 1408 powershell.exe
6 1408 powershell.exe
7 1408 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

964 powershell.exe
1408 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 964 powershell.exe
Token: SeDebugPrivilege 1408 powershell.exe

pid	process
964	powershell.exe
1408	powershell.exe

description	pid	process
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 964 wrote to memory of 1408	964	powershell.exe	powershell.exe
PID 964 wrote to memory of 1408	964	powershell.exe	powershell.exe
PID 964 wrote to memory of 1408	964	powershell.exe	powershell.exe
PID 964 wrote to memory of 1408	964	powershell.exe	powershell.exe

memory/964-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x0000000002680000-0x0000000002682000-memory.dmp

Filesize
8KB

Download
memory/964-57-0x0000000002682000-0x0000000002684000-memory.dmp

Filesize
8KB

Download
memory/964-58-0x0000000002684000-0x0000000002687000-memory.dmp

Filesize
12KB

Download
memory/964-55-0x000007FEF2830000-0x000007FEF338D000-memory.dmp

Filesize
11.4MB

Download
memory/964-59-0x000000000268B000-0x00000000026AA000-memory.dmp

Filesize
124KB

Download
memory/1408-60-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1408-63-0x0000000002530000-0x000000000317A000-memory.dmp

Filesize
12.3MB

Download
memory/1408-64-0x0000000002530000-0x000000000317A000-memory.dmp

Filesize
12.3MB

Download
memory/1408-65-0x0000000004FF0000-0x0000000005023000-memory.dmp

Filesize
204KB

Download