cobaltstrike | 95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481

Resubmissions

27-08-2021 12:10

23-07-2021 13:10

Target

583ad904b51ce0851f9f2cb056a9a2e3.exe
Size

457KB
MD5

583ad904b51ce0851f9f2cb056a9a2e3
SHA1

daa33b986624b2156b336392c4d5cc1ddd184e56
SHA256

95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481
SHA512

ec96716efc1fe8662df5d9f0defa0f9d831a794d96bf8b5ad6c663395dd97c4127dbb4c1e8f73185a001722ef7861bedefda598df91739fd0a43ee05940d8f9c

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

description pid process target process

PID 1672 created 1180 1672 583ad904b51ce0851f9f2cb056a9a2e3.exe Explorer.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

pid process

1672 583ad904b51ce0851f9f2cb056a9a2e3.exe

description	pid	process	target process
PID 1672 created 1180	1672	583ad904b51ce0851f9f2cb056a9a2e3.exe	Explorer.EXE

pid	process
1672	583ad904b51ce0851f9f2cb056a9a2e3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

description	pid	process	target process
PID 1672 wrote to memory of 1736	1672	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe
PID 1672 wrote to memory of 1736	1672	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe
PID 1672 wrote to memory of 1736	1672	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe

C:\Users\Admin\AppData\Local\Temp\583ad904b51ce0851f9f2cb056a9a2e3.exe
C:\Users\Admin\AppData\Local\Temp\583ad904b51ce0851f9f2cb056a9a2e3.exe 1
2⤵
PID:1736

memory/1672-59-0x0000000140000000-0x0000000140069000-memory.dmp

Filesize
420KB

Download
memory/1672-66-0x0000000000310000-0x0000000000375000-memory.dmp

Filesize
404KB

Download
memory/1736-65-0x0000000000000000-mapping.dmp

Download
memory/1736-73-0x0000000076FA0000-0x00000000770BF000-memory.dmp

Filesize
1.1MB

Download
memory/1736-74-0x000007FEFD9B0000-0x000007FEFDA8B000-memory.dmp

Filesize
876KB

Download
memory/1736-75-0x000007FEFC520000-0x000007FEFC57B000-memory.dmp

Filesize
364KB

Download
memory/1736-76-0x000007FEFDB60000-0x000007FEFDDA0000-memory.dmp

Filesize
2.2MB

Download
memory/1736-77-0x000007FEFDA90000-0x000007FEFDADD000-memory.dmp

Filesize
308KB

Download
memory/1736-78-0x000007FEFA8D0000-0x000007FEFA8F7000-memory.dmp

Filesize
156KB

Download
memory/1736-79-0x000007FEFCFE0000-0x000007FEFD04C000-memory.dmp

Filesize
432KB

Download
memory/1736-80-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1736-81-0x00000000025D0000-0x0000000002655000-memory.dmp

Filesize
532KB

Download