Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31-07-2023 11:40
Behavioral task
behavioral1
Sample
payload.ps1
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
payload.ps1
Resource
win10v2004-20230703-en
General
-
Target
payload.ps1
-
Size
3KB
-
MD5
a8c07cd267437f10a9df21e009b96bb9
-
SHA1
5a7b260b162390234f7a2d1973c2e00ca7cebc71
-
SHA256
78223bf0a9ad3bbe1de87c87c1a79ba38c96cd5b18da404430a8aa67309bad49
-
SHA512
6ca0868edd01ec1b993f329e7e5ecdaa2070fa2c0e936539d48d02c971c5314b817ea1efd96695507a1f04538af6003e4b9337a06db37dd3630645fe6bf146db
Malware Config
Extracted
metasploit
windows/download_exec
http://101.35.235.73:8888/fqR3
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Extracted
cobaltstrike
305419896
http://101.35.235.73:8888/updates.rss
-
access_type
512
-
host
101.35.235.73,/updates.rss
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
8888
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTUlJ7J79z/MkkV8+MsYlOvREE2hhdGNzrKPFZ10lY0K5legA+um5JxESEaC0woDgSmOGrkh1giz/aQwd6tG4mihFgpi0oIbfwu6XZbE6ghYGyu2F7+A5TifRUzvU0YLXjK78EW12XhjHx4KopMF/AtOAueGwfiI2DmXwNzrBDvwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent
-
watermark
305419896
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exeflow pid process 4 2136 powershell.exe 5 2136 powershell.exe 6 2136 powershell.exe 7 2136 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 936 powershell.exe 2136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 936 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
powershell.exedescription pid process target process PID 936 wrote to memory of 2136 936 powershell.exe powershell.exe PID 936 wrote to memory of 2136 936 powershell.exe powershell.exe PID 936 wrote to memory of 2136 936 powershell.exe powershell.exe PID 936 wrote to memory of 2136 936 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\950EQCHSBS7FRB6UULY6.tempFilesize
7KB
MD5ce080550741779ff7e9faa81aa824f43
SHA1b88de30ad69859889cfba82e650f8b8ddbc4c5cb
SHA256a7a485f58c3461eac5d9aca22059d20fced109100171e86542cf30841420d3e0
SHA5120521239c24fafca8c25edaf6429b33837850a2a06dcf88914c33e5dcbbceff387e09188a1ad892bd3b9b9fda1e1deff2fbb681017d4fc8eb89ede7a7b5438498
-
memory/936-80-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-66-0x00000000025E0000-0x0000000002612000-memory.dmpFilesize
200KB
-
memory/936-74-0x000007FEF5970000-0x000007FEF630D000-memory.dmpFilesize
9.6MB
-
memory/936-61-0x000007FEF5970000-0x000007FEF630D000-memory.dmpFilesize
9.6MB
-
memory/936-64-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-62-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-65-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-76-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-67-0x00000000025E0000-0x0000000002612000-memory.dmpFilesize
200KB
-
memory/936-60-0x000007FEF5970000-0x000007FEF630D000-memory.dmpFilesize
9.6MB
-
memory/936-58-0x000000001B4C0000-0x000000001B7A2000-memory.dmpFilesize
2.9MB
-
memory/936-78-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-63-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-59-0x0000000002220000-0x0000000002228000-memory.dmpFilesize
32KB
-
memory/936-77-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/936-75-0x000007FEF5970000-0x000007FEF630D000-memory.dmpFilesize
9.6MB
-
memory/2136-86-0x0000000005650000-0x000000000568D000-memory.dmpFilesize
244KB
-
memory/2136-81-0x0000000073320000-0x00000000738CB000-memory.dmpFilesize
5.7MB
-
memory/2136-71-0x0000000073320000-0x00000000738CB000-memory.dmpFilesize
5.7MB
-
memory/2136-79-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/2136-70-0x0000000073320000-0x00000000738CB000-memory.dmpFilesize
5.7MB
-
memory/2136-72-0x0000000002460000-0x00000000024A0000-memory.dmpFilesize
256KB
-
memory/2136-82-0x0000000073320000-0x00000000738CB000-memory.dmpFilesize
5.7MB
-
memory/2136-83-0x0000000002460000-0x00000000024A0000-memory.dmpFilesize
256KB
-
memory/2136-84-0x0000000005A00000-0x0000000005E00000-memory.dmpFilesize
4.0MB
-
memory/2136-85-0x0000000005650000-0x000000000568D000-memory.dmpFilesize
244KB
-
memory/2136-73-0x0000000002460000-0x00000000024A0000-memory.dmpFilesize
256KB