cobaltstrike | 95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481

Analysis

Target

583ad904b51ce0851f9f2cb056a9a2e3.exe
Size

457KB
MD5

583ad904b51ce0851f9f2cb056a9a2e3
SHA1

daa33b986624b2156b336392c4d5cc1ddd184e56
SHA256

95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481
SHA512

ec96716efc1fe8662df5d9f0defa0f9d831a794d96bf8b5ad6c663395dd97c4127dbb4c1e8f73185a001722ef7861bedefda598df91739fd0a43ee05940d8f9c

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

description pid process target process

PID 3904 created 2116 3904 583ad904b51ce0851f9f2cb056a9a2e3.exe Explorer.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

pid process

3904 583ad904b51ce0851f9f2cb056a9a2e3.exe
3904 583ad904b51ce0851f9f2cb056a9a2e3.exe

description	pid	process	target process
PID 3904 created 2116	3904	583ad904b51ce0851f9f2cb056a9a2e3.exe	Explorer.EXE

pid	process
3904	583ad904b51ce0851f9f2cb056a9a2e3.exe
3904	583ad904b51ce0851f9f2cb056a9a2e3.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

description	pid	process	target process
PID 3904 wrote to memory of 3796	3904	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe
PID 3904 wrote to memory of 3796	3904	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe

C:\Users\Admin\AppData\Local\Temp\583ad904b51ce0851f9f2cb056a9a2e3.exe
C:\Users\Admin\AppData\Local\Temp\583ad904b51ce0851f9f2cb056a9a2e3.exe 1
2⤵
PID:3796

memory/3796-120-0x0000000000000000-mapping.dmp

Download
memory/3796-128-0x00007FFA62EA0000-0x00007FFA62F4E000-memory.dmp

Filesize
696KB

Download
memory/3796-129-0x00007FFA62C80000-0x00007FFA62D21000-memory.dmp

Filesize
644KB

Download
memory/3796-130-0x00007FFA60230000-0x00007FFA602D4000-memory.dmp

Filesize
656KB

Download
memory/3796-131-0x00007FFA4A490000-0x00007FFA4A7BE000-memory.dmp

Filesize
3.2MB

Download
memory/3796-132-0x00007FFA62BB0000-0x00007FFA62C1C000-memory.dmp

Filesize
432KB

Download
memory/3796-133-0x00007FFA601F0000-0x00007FFA60227000-memory.dmp

Filesize
220KB

Download
memory/3796-134-0x00007FFA60F10000-0x00007FFA61159000-memory.dmp

Filesize
2.3MB

Download
memory/3796-135-0x00000000005C0000-0x0000000000600000-memory.dmp

Filesize
256KB

Download
memory/3796-136-0x0000000002CB0000-0x0000000002D35000-memory.dmp

Filesize
532KB

Download
memory/3904-114-0x0000000140000000-0x0000000140069000-memory.dmp

Filesize
420KB

Download
memory/3904-121-0x0000000000480000-0x00000000004E5000-memory.dmp

Filesize
404KB

Download