Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
24/03/2024, 10:01
General
- Target 393f0753c219b45f1fdbbc9fe4cdb57f335ff11536e718f0bd78d21191bf203e.exe
- Size 19KB
- Sample240324-l2dbssed71
- SHA256 393f0753c219b45f1fdbbc9fe4cdb57f335ff11536e718f0bd78d21191bf203e
Malware Config
Extracted
-
cobaltstrike
-
http://dns.nikosc.lol:8880/QOKr
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\393f0753c219b45f1fdbbc9fe4cdb57f335ff11536e718f0bd78d21191bf203e.exe"C:\Users\Admin\AppData\Local\Temp\393f0753c219b45f1fdbbc9fe4cdb57f335ff11536e718f0bd78d21191bf203e.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/3920-54-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-55-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-81-0x0000022FC87B0000-0x0000022FC87B1000-memory.dmp
memory/3920-69-0x0000022FC85B0000-0x0000022FC85B1000-memory.dmp
memory/3920-17-0x0000022FC0340000-0x0000022FC0350000-memory.dmp
memory/3920-33-0x0000022FC0440000-0x0000022FC0450000-memory.dmp
memory/3920-66-0x0000022FC8670000-0x0000022FC8671000-memory.dmp
memory/3920-50-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-51-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-52-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-63-0x0000022FC8680000-0x0000022FC8681000-memory.dmp
memory/3920-49-0x0000022FC8A30000-0x0000022FC8A31000-memory.dmp
memory/3920-59-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-56-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-57-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-58-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-53-0x0000022FC8A60000-0x0000022FC8A61000-memory.dmp
memory/3920-60-0x0000022FC8680000-0x0000022FC8681000-memory.dmp
memory/3920-61-0x0000022FC8670000-0x0000022FC8671000-memory.dmp
memory/4984-2-0x0000000003B00000-0x0000000003B56000-memory.dmp
memory/4984-0-0x0000000000020000-0x0000000000021000-memory.dmp
memory/4984-5-0x0000000003B00000-0x0000000003B56000-memory.dmp
memory/4984-1-0x0000000003700000-0x0000000003B00000-memory.dmp
memory/4984-3-0x0000000000400000-0x000000000040C000-memory.dmp