e903253b73d3e43e98088dce800bd5fb75c9b2786153c6d0150080c1d002bbb3 | Triage

Analysis

max time kernel
88s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 11:13

Sharing

Report Analysis Logs

General

Target

temp/CS4.9/Cobalt_Strike.bat
Size

139B
MD5

223ea4ed52ff6bab8f8c9616c0139e1b
SHA1

fd05a9fd71565c92ebe3d6eeba017c62868839dd
SHA256

3c4a434f5d3a7ab2e340d1ab298ab0d0501fb604853c9a57f3fb1bba33050d41
SHA512

f4847d49816bde174dd838ad95ee987a943fb7d606c83ad7bb43db7a96e8a3e48360027b1d36bbe9e9adc9dab93ed732bc79965c1a3062c9c42239045e183172

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3244	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 3244	3132	cmd.exe	88
PID 3132 wrote to memory of 3244	3132	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp\CS4.9\Cobalt_Strike.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:uHook.jar -Dfile.encoding=utf-8 -jar cobaltstrike-client.jar
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-2-0x000002100E550000-0x000002100E7C0000-memory.dmp

Filesize
2.4MB

Download
memory/3244-3-0x000002100E550000-0x000002100E7C0000-memory.dmp

Filesize
2.4MB

Download