Analysis

  • max time kernel
    124s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 11:49

General

  • Target

    b4a178f81cea722e3cf6fe060ede84d0.ps1

  • Size

    220KB

  • MD5

    b4a178f81cea722e3cf6fe060ede84d0

  • SHA1

    051253c4004c96393a0fd93028b8cfbd12c6fe0b

  • SHA256

    bd5dc63a79db22b93c9a553eaebb4b800f849b200792e3681bb795d8cbbd3c79

  • SHA512

    9fe0e59d640bae6e6affacd9ff7c9de92f8c549db8e100c0b3915860e6a33c631bab193350580b0875ee11951951aa7d8307867c8b050f964a701d249efb5c32

  • SSDEEP

    3072:5GZo0xa5t8kCOocz6B+ns1aDN9npOra/Eg8/qZfaVUZzVqzRzYUTHX146oEX5K5E:5Eta78ga1aDNbOpyZ+EcRzYUT31K0UE

Malware Config

Extracted

Family

cobaltstrike

Botnet

1501634718

C2

http://golfcdn.com:443/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    golfcdn.com,/jquery-3.3.1.min.js

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    6912

  • polling_time

    45000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOoVdEVmZpKVm5UNd8iyiMbbx61ii5t+uYxhZsscGf3sakc8UAzcWM5g7uGqPYjpMhFxQx9GD+bs/D5PJhAaETgeL+3Ezw6mrK2Mn3GtjPbzn2hlTC4MdP4/UixlyFhAUz/EiLxJhWc97oxYpdc+/364DB3T9SNHM6ibZixiPJawIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /jquery-3.3.2.min.js

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

  • watermark

    1501634718

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b4a178f81cea722e3cf6fe060ede84d0.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2012

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2012-5-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

          Filesize

          9.6MB

        • memory/2012-4-0x000000001B490000-0x000000001B772000-memory.dmp

          Filesize

          2.9MB

        • memory/2012-6-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-7-0x0000000002310000-0x0000000002318000-memory.dmp

          Filesize

          32KB

        • memory/2012-8-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

          Filesize

          9.6MB

        • memory/2012-10-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-9-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-11-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-13-0x0000000002AC0000-0x0000000002B01000-memory.dmp

          Filesize

          260KB

        • memory/2012-12-0x000000001CA60000-0x000000001CED2000-memory.dmp

          Filesize

          4.4MB

        • memory/2012-14-0x000000001CA60000-0x000000001CED2000-memory.dmp

          Filesize

          4.4MB

        • memory/2012-15-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

          Filesize

          9.6MB

        • memory/2012-16-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-17-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-18-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB

        • memory/2012-19-0x0000000002B40000-0x0000000002BC0000-memory.dmp

          Filesize

          512KB