cobaltstrike | 5d788fe9005c1db5c67e38ec338c023856c8d71f20e137020fbc292e216d3997

General

Target

40e85653abe687ddfd95b67a5f5dd452.exe
Size

403KB
MD5

40e85653abe687ddfd95b67a5f5dd452
SHA1

76eccc09ca37441e3f2b85e1bdeedaf33d434f1e
SHA256

5d788fe9005c1db5c67e38ec338c023856c8d71f20e137020fbc292e216d3997
SHA512

78641bfcf5d56f657a4d758807077563b8a80ed1fa6bdbfac65454b2a721474ef3813e189ac1c2a0091cc79bf3ed44252e31f8216598db4cb2c0503171b4be57

Score

10^/10

Family

cobaltstrike

C2

http://Uw0soheevahjahsaifae.glowtrow.fun:443/image/

http://bah1tuquaizia9eu3Ume.glowtrow.site:443/created/

http://seudaize6io3Go0quahC.cleans.space:443/static/

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1716 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

40e85653abe687ddfd95b67a5f5dd452.exe

description pid process target process

PID 1992 set thread context of 1776 1992 40e85653abe687ddfd95b67a5f5dd452.exe mstsc.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

240 timeout.exe

pid	process
1716	cmd.exe

description	pid	process	target process
PID 1992 set thread context of 1776	1992	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe

pid	process
240	timeout.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

40e85653abe687ddfd95b67a5f5dd452.execmd.exe

description	pid	process	target process
PID 1992 wrote to memory of 1776	1992	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 1992 wrote to memory of 1776	1992	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 1992 wrote to memory of 1776	1992	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 1992 wrote to memory of 1776	1992	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 1992 wrote to memory of 1716	1992	40e85653abe687ddfd95b67a5f5dd452.exe	cmd.exe
PID 1992 wrote to memory of 1716	1992	40e85653abe687ddfd95b67a5f5dd452.exe	cmd.exe
PID 1992 wrote to memory of 1716	1992	40e85653abe687ddfd95b67a5f5dd452.exe	cmd.exe
PID 1716 wrote to memory of 240	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 240	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 240	1716	cmd.exe	timeout.exe

C:\Windows\system32\timeout.exe
timeout 120
3⤵
- Delays execution with timeout.exe
PID:240

memory/240-6-0x0000000000000000-mapping.dmp

Download
memory/1716-4-0x0000000000000000-mapping.dmp

Download
memory/1776-0-0x0000000000060000-0x00000000000A0000-memory.dmp

Filesize
256KB

Download
memory/1776-1-0x0000000000060000-0x00000000000A0000-memory.dmp

Filesize
256KB

Download
memory/1776-3-0x0000000000060000-mapping.dmp

Download
memory/1776-5-0x0000000001C90000-0x0000000001E9F000-memory.dmp

Filesize
2.1MB

Download
memory/1776-8-0x0000000001C90000-0x0000000001E9F000-memory.dmp

Filesize
2.1MB

Download
memory/1932-7-0x000007FEF6850000-0x000007FEF6ACA000-memory.dmp

Filesize
2.5MB

Download