Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 14:33
Behavioral task
behavioral1
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win10v2004-20230220-en
General
-
Target
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
-
Size
279KB
-
MD5
8f96176279d6d78c3e40044939e028e6
-
SHA1
92b67e98138f65bbb6469afafb71cd49cde7a321
-
SHA256
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98
-
SHA512
252bbfa9101662d59101d0599665cb3d41b7138742987b4ed3d1ee7a611e91b172a45c0a41ad0ee7d3514be08b0a83e827717e300df71a9e35535cb9219418e4
-
SSDEEP
6144:oxzX5tk9wGd8b6JDuwgCNx88x/4eVU68RgRXswQqn:+/kp8b6JDzxoqg8xRXQu
Malware Config
Extracted
cobaltstrike
100000
http://152.89.196.245:6789/match
-
access_type
512
-
host
152.89.196.245,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6789
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGFu6deNj54GwQLP/gvk2IXPhruZshiQwL+BaZCmm7xzfvvedCsNPTMAP+e3/zIeWtvCIby0zsYFDuKnF38h/iLsx3/vugYI9OQgXer0XD6u2mw0uO2bTdGz17fVzT4rJwxJo5PcF3qf/SXprY5GtDWKYffr6NCSrsLFDS2oLpbwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 10 IoCs
Processes:
powershell.exeflow pid process 3 520 powershell.exe 5 520 powershell.exe 6 520 powershell.exe 7 520 powershell.exe 8 520 powershell.exe 9 520 powershell.exe 10 520 powershell.exe 11 520 powershell.exe 12 520 powershell.exe 13 520 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1920 powershell.exe 520 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1920 powershell.exe Token: SeDebugPrivilege 520 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
powershell.exedescription pid process target process PID 1920 wrote to memory of 520 1920 powershell.exe powershell.exe PID 1920 wrote to memory of 520 1920 powershell.exe powershell.exe PID 1920 wrote to memory of 520 1920 powershell.exe powershell.exe PID 1920 wrote to memory of 520 1920 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YJJGE1UHZLS7184G47C4.tempFilesize
7KB
MD566eea56fe2770399c0748a3f24f57188
SHA1d2af3a71c13d8033c4ffc46275c4f47bb693e0e4
SHA256920337e9dc5990b49a1aa79f81ac05a53b9585f7a2d3b858e8d2839868773646
SHA5125b99f8883f106efa2ae3b1d20777b0ae109433e43b82df6c92375899f09665e2c958828ad76a10fe77e854f6a201619bc39cfd0238a370eb4c3c94659ce8416b
-
memory/520-74-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/520-70-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/520-69-0x00000000051F0000-0x0000000005224000-memory.dmpFilesize
208KB
-
memory/520-68-0x0000000002770000-0x00000000027B0000-memory.dmpFilesize
256KB
-
memory/520-67-0x0000000002770000-0x00000000027B0000-memory.dmpFilesize
256KB
-
memory/1920-62-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1920-63-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1920-64-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1920-58-0x000000001B450000-0x000000001B732000-memory.dmpFilesize
2.9MB
-
memory/1920-61-0x00000000028F0000-0x0000000002922000-memory.dmpFilesize
200KB
-
memory/1920-60-0x00000000028F0000-0x0000000002922000-memory.dmpFilesize
200KB
-
memory/1920-73-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1920-72-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1920-71-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1920-59-0x0000000001D60000-0x0000000001D68000-memory.dmpFilesize
32KB