e903253b73d3e43e98088dce800bd5fb75c9b2786153c6d0150080c1d002bbb3 | Triage

Analysis

max time kernel
9s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 11:13

Sharing

Report Analysis Logs

General

Target

temp/CS4.9/Cobalt_Strike.bat
Size

139B
MD5

223ea4ed52ff6bab8f8c9616c0139e1b
SHA1

fd05a9fd71565c92ebe3d6eeba017c62868839dd
SHA256

3c4a434f5d3a7ab2e340d1ab298ab0d0501fb604853c9a57f3fb1bba33050d41
SHA512

f4847d49816bde174dd838ad95ee987a943fb7d606c83ad7bb43db7a96e8a3e48360027b1d36bbe9e9adc9dab93ed732bc79965c1a3062c9c42239045e183172

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2492	java.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2492	2320	cmd.exe	30
PID 2320 wrote to memory of 2492	2320	cmd.exe	30
PID 2320 wrote to memory of 2492	2320	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\temp\CS4.9\Cobalt_Strike.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\java.exe
  java -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:uHook.jar -Dfile.encoding=utf-8 -jar cobaltstrike-client.jar
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-2-0x0000000002710000-0x0000000002980000-memory.dmp

Filesize
2.4MB

Download
memory/2492-7-0x0000000002710000-0x0000000002980000-memory.dmp

Filesize
2.4MB

Download