Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2023 23:44
Behavioral task
behavioral1
Sample
payload.ps1
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
payload.ps1
Resource
win10v2004-20230915-en
General
-
Target
payload.ps1
-
Size
3KB
-
MD5
d79b65346b6e1435d7fd66e1a37646fb
-
SHA1
974602784f1e4f17b71ddd7cb11527a4464c4198
-
SHA256
2a44af35c9371b6a6bc6341d2799ca1d244c93522f34370302b312970e2814e5
-
SHA512
fd7dd6511c1d0e92b1e7a5513aca070800b72c99b3d63ff001b1de0befd54a50fc0977da5997ff74a6797739d277d60ed5cad9eb4b24c72ef7a5c2ead77daebd
Malware Config
Extracted
metasploit
windows/download_exec
http://124.221.0.93:7080/wDQP
- headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 2.0.50727)
Extracted
cobaltstrike
100000
http://124.221.0.93:7080/push
-
access_type
512
-
host
124.221.0.93,/push
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
7080
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCK8fRrR8ygyM5q31TvJMdmA3PSJ5MI/msymzvVFgw/O6xho0tS7uoFa0/IBlWUtojWjOur06gpA+TEjLldBn7miIClnRma5I/X+Sxc11C+Z+QGO6ct5f5TyRKsNA537DKoek9z+XV+uD12wdo348nevwz6s4G9VgTPxzoW44AcMwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MATMJS)
-
watermark
100000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exeflow pid process 29 5024 powershell.exe 31 5024 powershell.exe 49 5024 powershell.exe 59 5024 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3844 powershell.exe 3844 powershell.exe 5024 powershell.exe 5024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3844 powershell.exe Token: SeDebugPrivilege 5024 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 3844 wrote to memory of 5024 3844 powershell.exe powershell.exe PID 3844 wrote to memory of 5024 3844 powershell.exe powershell.exe PID 3844 wrote to memory of 5024 3844 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD593678e82d776686aa54c42b8a98e6cbc
SHA1802939dfed99ac74814c4371388b204c5810241d
SHA256da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841
SHA5120b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_teoe1phf.bte.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3844-9-0x000002415A510000-0x000002415A532000-memory.dmpFilesize
136KB
-
memory/3844-10-0x00007FFA263E0000-0x00007FFA26EA1000-memory.dmpFilesize
10.8MB
-
memory/3844-11-0x000002415A4C0000-0x000002415A4D0000-memory.dmpFilesize
64KB
-
memory/3844-12-0x000002415A4C0000-0x000002415A4D0000-memory.dmpFilesize
64KB
-
memory/3844-13-0x0000024173850000-0x00000241739C6000-memory.dmpFilesize
1.5MB
-
memory/3844-14-0x0000024173BE0000-0x0000024173DEA000-memory.dmpFilesize
2.0MB
-
memory/3844-15-0x00007FFA263E0000-0x00007FFA26EA1000-memory.dmpFilesize
10.8MB
-
memory/3844-17-0x000002415A4C0000-0x000002415A4D0000-memory.dmpFilesize
64KB
-
memory/3844-18-0x000002415A4C0000-0x000002415A4D0000-memory.dmpFilesize
64KB
-
memory/5024-24-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/5024-39-0x0000000006E90000-0x0000000006EAA000-memory.dmpFilesize
104KB
-
memory/5024-21-0x0000000005920000-0x0000000005F48000-memory.dmpFilesize
6.2MB
-
memory/5024-22-0x0000000005F90000-0x0000000005FB2000-memory.dmpFilesize
136KB
-
memory/5024-23-0x0000000006040000-0x00000000060A6000-memory.dmpFilesize
408KB
-
memory/5024-19-0x0000000005290000-0x00000000052C6000-memory.dmpFilesize
216KB
-
memory/5024-30-0x0000000006250000-0x00000000065A4000-memory.dmpFilesize
3.3MB
-
memory/5024-35-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/5024-36-0x00000000069F0000-0x0000000006A0E000-memory.dmpFilesize
120KB
-
memory/5024-37-0x0000000006AF0000-0x0000000006B3C000-memory.dmpFilesize
304KB
-
memory/5024-38-0x0000000007880000-0x0000000007EFA000-memory.dmpFilesize
6.5MB
-
memory/5024-20-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/5024-41-0x0000000074B00000-0x00000000752B0000-memory.dmpFilesize
7.7MB
-
memory/5024-42-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/5024-43-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/5024-44-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/5024-45-0x0000000007390000-0x0000000007790000-memory.dmpFilesize
4.0MB
-
memory/5024-46-0x0000000007790000-0x00000000077CE000-memory.dmpFilesize
248KB
-
memory/5024-47-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/5024-48-0x0000000007790000-0x00000000077CE000-memory.dmpFilesize
248KB
-
memory/5024-16-0x0000000074B00000-0x00000000752B0000-memory.dmpFilesize
7.7MB