cobaltstrike | 5d788fe9005c1db5c67e38ec338c023856c8d71f20e137020fbc292e216d3997

Analysis

Target

40e85653abe687ddfd95b67a5f5dd452.exe
Size

403KB
MD5

40e85653abe687ddfd95b67a5f5dd452
SHA1

76eccc09ca37441e3f2b85e1bdeedaf33d434f1e
SHA256

5d788fe9005c1db5c67e38ec338c023856c8d71f20e137020fbc292e216d3997
SHA512

78641bfcf5d56f657a4d758807077563b8a80ed1fa6bdbfac65454b2a721474ef3813e189ac1c2a0091cc79bf3ed44252e31f8216598db4cb2c0503171b4be57

Score

10^/10

Family

cobaltstrike

http://Uw0soheevahjahsaifae.glowtrow.fun:443/image/

http://bah1tuquaizia9eu3Ume.glowtrow.site:443/created/

http://seudaize6io3Go0quahC.cleans.space:443/static/

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious use of SetThreadContext 1 IoCs

Processes:

40e85653abe687ddfd95b67a5f5dd452.exe

description pid process target process

PID 656 set thread context of 1840 656 40e85653abe687ddfd95b67a5f5dd452.exe mstsc.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3120 timeout.exe

description	pid	process	target process
PID 656 set thread context of 1840	656	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe

pid	process
3120	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

40e85653abe687ddfd95b67a5f5dd452.execmd.exe

description	pid	process	target process
PID 656 wrote to memory of 1840	656	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 656 wrote to memory of 1840	656	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 656 wrote to memory of 1840	656	40e85653abe687ddfd95b67a5f5dd452.exe	mstsc.exe
PID 656 wrote to memory of 2360	656	40e85653abe687ddfd95b67a5f5dd452.exe	cmd.exe
PID 656 wrote to memory of 2360	656	40e85653abe687ddfd95b67a5f5dd452.exe	cmd.exe
PID 2360 wrote to memory of 3120	2360	cmd.exe	timeout.exe
PID 2360 wrote to memory of 3120	2360	cmd.exe	timeout.exe

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C timeout 120 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\40e85653abe687ddfd95b67a5f5dd452.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\system32\timeout.exe
timeout 120
3⤵
- Delays execution with timeout.exe
PID:3120

memory/1840-0-0x000001A091D00000-0x000001A091D40000-memory.dmp

Filesize
256KB

Download
memory/1840-2-0x000001A091D00000-mapping.dmp

Download
memory/1840-5-0x000001A093730000-0x000001A09393F000-memory.dmp

Filesize
2.1MB

Download
memory/1840-6-0x000001A093730000-0x000001A09393F000-memory.dmp

Filesize
2.1MB

Download
memory/2360-3-0x0000000000000000-mapping.dmp

Download
memory/3120-4-0x0000000000000000-mapping.dmp

Download