Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 17:26
General
- Target 07be0afdd645d8d0f8ccb48fa873932711325412adb9acf2179bda7bc6fa53f2.ps1
- Size 1.8MB
- Sample261007-vzzxfsbf68
- SHA256 07be0afdd645d8d0f8ccb48fa873932711325412adb9acf2179bda7bc6fa53f2
Malware Config
Extracted
-
cobaltstrike
-
86281208
-
http://69.49.229.88:443/MQEw
-
access_type
512
-
beacon_type
2048
-
host
69.49.229.88
-
http_header1
AAAACgAAACVVc2VyLUFnZW50OiBNaWNyb3NvZnQtQ3J5cHRvQVBJIC8xMC4wAAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jc3AtcmVxdWVzdAAAAAcAAAAAAAAADwAAAA0AAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACVVc2VyLUFnZW50OiBNaWNyb3NvZnQtQ3J5cHRvQVBJIC8xMC4wAAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jc3AtcmVxdWVzdAAAAAcAAAAAAAAABgAAAARFdGFnAAAABwAAAAEAAAAPAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
8960
-
polling_time
45000
-
port_number
443
-
sc_process32
%windir%\syswow64\svchost.exe
-
sc_process64
%windir%\sysnative\svchost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGbP7Icq4IQIXkDR933AXP13+jzWO3NmXoZRRIF1ypnXlSt/sE1f/URw82z5tlblHu9dgfE8fYNvWh9isWHx5UXpBsB1e58MQXQHzRHOIdUUkDb0p7N45SBzL4hqOC2I79SLfBzsycA4JJ7XPt47vCVpbx1QtgVwv4CiHgIu61rwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
6.711296e+07
-
unknown2
AAAABAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/ocsp4
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MAARJS)
-
watermark
86281208
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\07be0afdd645d8d0f8ccb48fa873932711325412adb9acf2179bda7bc6fa53f2.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1364-0-0x00007FF863C6F000-0x00007FF863C70000-memory.dmp
memory/1364-4-0x0000028A7BB30000-0x0000028A7BB52000-memory.dmp
memory/1364-5-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-1-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-6-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-7-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-8-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-9-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-10-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-11-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-12-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-13-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-14-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-15-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-17-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-16-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-18-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-19-0x0000028A7C5A0000-0x0000028A7C6B3000-memory.dmp
memory/1364-20-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-21-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-22-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-23-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-25-0x00007FF863AE0000-0x00007FF864484000-memory.dmp