Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 01:38
Behavioral task
behavioral1
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
Resource
win10v2004-20230220-en
General
-
Target
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps1
-
Size
279KB
-
MD5
8f96176279d6d78c3e40044939e028e6
-
SHA1
92b67e98138f65bbb6469afafb71cd49cde7a321
-
SHA256
f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98
-
SHA512
252bbfa9101662d59101d0599665cb3d41b7138742987b4ed3d1ee7a611e91b172a45c0a41ad0ee7d3514be08b0a83e827717e300df71a9e35535cb9219418e4
-
SSDEEP
6144:oxzX5tk9wGd8b6JDuwgCNx88x/4eVU68RgRXswQqn:+/kp8b6JDzxoqg8xRXQu
Malware Config
Extracted
cobaltstrike
100000
http://152.89.196.245:6789/match
-
access_type
512
-
host
152.89.196.245,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
6789
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGFu6deNj54GwQLP/gvk2IXPhruZshiQwL+BaZCmm7xzfvvedCsNPTMAP+e3/zIeWtvCIby0zsYFDuKnF38h/iLsx3/vugYI9OQgXer0XD6u2mw0uO2bTdGz17fVzT4rJwxJo5PcF3qf/SXprY5GtDWKYffr6NCSrsLFDS2oLpbwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 10 IoCs
Processes:
powershell.exeflow pid process 3 980 powershell.exe 5 980 powershell.exe 6 980 powershell.exe 7 980 powershell.exe 8 980 powershell.exe 9 980 powershell.exe 10 980 powershell.exe 11 980 powershell.exe 12 980 powershell.exe 13 980 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1696 powershell.exe 980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 980 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
powershell.exedescription pid process target process PID 1696 wrote to memory of 980 1696 powershell.exe powershell.exe PID 1696 wrote to memory of 980 1696 powershell.exe powershell.exe PID 1696 wrote to memory of 980 1696 powershell.exe powershell.exe PID 1696 wrote to memory of 980 1696 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f404d26706ef08f01e7d08bd24e572c523085f2c07601390c42e64261bc6df98.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UBJLUUJXLRXGTW6LX2QU.tempFilesize
7KB
MD5102ee7d5ef652bd80821dbe516ee5d9b
SHA1cf9757e910c9f074960f2e9be6534efe12884ed7
SHA256b934cf2d2b2eb43e4fa0133d70c12f96269be30fd5ddb61cd946cebcf918f47e
SHA5127688b8e92af1a9cf62056a2009f1e51cd94606767715c992b79fc4e64c20543ec7b7bd408365f7509b2c4cd57c5a572a2d28da54c682452b63f36e6812609735
-
memory/980-75-0x0000000005260000-0x000000000529E000-memory.dmpFilesize
248KB
-
memory/980-70-0x0000000005260000-0x000000000529E000-memory.dmpFilesize
248KB
-
memory/980-69-0x0000000004D70000-0x0000000004DA4000-memory.dmpFilesize
208KB
-
memory/980-68-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/980-67-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1696-62-0x0000000002880000-0x00000000028B2000-memory.dmpFilesize
200KB
-
memory/1696-66-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-63-0x0000000002880000-0x00000000028B2000-memory.dmpFilesize
200KB
-
memory/1696-58-0x000000001B3A0000-0x000000001B682000-memory.dmpFilesize
2.9MB
-
memory/1696-61-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-60-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-71-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-72-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-73-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-74-0x0000000002700000-0x0000000002780000-memory.dmpFilesize
512KB
-
memory/1696-59-0x00000000022E0000-0x00000000022E8000-memory.dmpFilesize
32KB