Analysis
-
max time kernel
130s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
20-09-2023 23:44
Behavioral task
behavioral1
Sample
payload.ps1
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
payload.ps1
Resource
win10v2004-20230915-en
General
-
Target
payload.ps1
-
Size
3KB
-
MD5
d79b65346b6e1435d7fd66e1a37646fb
-
SHA1
974602784f1e4f17b71ddd7cb11527a4464c4198
-
SHA256
2a44af35c9371b6a6bc6341d2799ca1d244c93522f34370302b312970e2814e5
-
SHA512
fd7dd6511c1d0e92b1e7a5513aca070800b72c99b3d63ff001b1de0befd54a50fc0977da5997ff74a6797739d277d60ed5cad9eb4b24c72ef7a5c2ead77daebd
Malware Config
Extracted
metasploit
windows/download_exec
http://124.221.0.93:7080/wDQP
- headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 2.0.50727)
Extracted
cobaltstrike
100000
http://124.221.0.93:7080/push
-
access_type
512
-
host
124.221.0.93,/push
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
7080
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCK8fRrR8ygyM5q31TvJMdmA3PSJ5MI/msymzvVFgw/O6xho0tS7uoFa0/IBlWUtojWjOur06gpA+TEjLldBn7miIClnRma5I/X+Sxc11C+Z+QGO6ct5f5TyRKsNA537DKoek9z+XV+uD12wdo348nevwz6s4G9VgTPxzoW44AcMwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MATMJS)
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exeflow pid process 3 2648 powershell.exe 5 2648 powershell.exe 6 2648 powershell.exe 9 2648 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2336 powershell.exe 2648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2336 powershell.exe Token: SeDebugPrivilege 2648 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
powershell.exedescription pid process target process PID 2336 wrote to memory of 2648 2336 powershell.exe powershell.exe PID 2336 wrote to memory of 2648 2336 powershell.exe powershell.exe PID 2336 wrote to memory of 2648 2336 powershell.exe powershell.exe PID 2336 wrote to memory of 2648 2336 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UJ9Y1ERU1AI73D7WQPB4.tempFilesize
7KB
MD54c94fdab17d6a8bbe7e75435fd2e38a7
SHA100ab41c6243bfedde2ccb14ecee5fb99a2e54812
SHA256cb8d719bc79f4db35ce0930687cfd1099828ef8d8c1092c7759ab7fdfc9fae24
SHA5129e5960063e41c76b49da7eaadb58f2e92f62a74b2d7ed8c84f7e92abae4dae423a4217302dea354c25a7d050bf2d4d2a8b4558f0eae383101c18d44f6fe4bae6
-
memory/2336-12-0x0000000002970000-0x00000000029A2000-memory.dmpFilesize
200KB
-
memory/2336-13-0x0000000002970000-0x00000000029A2000-memory.dmpFilesize
200KB
-
memory/2336-8-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-9-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-6-0x00000000024E0000-0x00000000024E8000-memory.dmpFilesize
32KB
-
memory/2336-10-0x000007FEF55A0000-0x000007FEF5F3D000-memory.dmpFilesize
9.6MB
-
memory/2336-7-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-22-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-11-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-4-0x000000001B3D0000-0x000000001B6B2000-memory.dmpFilesize
2.9MB
-
memory/2336-25-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-24-0x000007FEF55A0000-0x000007FEF5F3D000-memory.dmpFilesize
9.6MB
-
memory/2336-23-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2336-5-0x000007FEF55A0000-0x000007FEF5F3D000-memory.dmpFilesize
9.6MB
-
memory/2336-20-0x000007FEF55A0000-0x000007FEF5F3D000-memory.dmpFilesize
9.6MB
-
memory/2648-19-0x0000000002670000-0x00000000026B0000-memory.dmpFilesize
256KB
-
memory/2648-21-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2648-18-0x0000000002670000-0x00000000026B0000-memory.dmpFilesize
256KB
-
memory/2648-17-0x0000000073240000-0x00000000737EB000-memory.dmpFilesize
5.7MB
-
memory/2648-16-0x0000000073240000-0x00000000737EB000-memory.dmpFilesize
5.7MB
-
memory/2648-26-0x0000000005C10000-0x0000000006010000-memory.dmpFilesize
4.0MB
-
memory/2648-27-0x0000000005340000-0x000000000537E000-memory.dmpFilesize
248KB
-
memory/2648-28-0x0000000073240000-0x00000000737EB000-memory.dmpFilesize
5.7MB
-
memory/2648-29-0x0000000002670000-0x00000000026B0000-memory.dmpFilesize
256KB
-
memory/2648-30-0x0000000002670000-0x00000000026B0000-memory.dmpFilesize
256KB
-
memory/2648-31-0x0000000002670000-0x00000000026B0000-memory.dmpFilesize
256KB
-
memory/2648-32-0x0000000005340000-0x000000000537E000-memory.dmpFilesize
248KB