cobaltstrike | 95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481

Resubmissions

27-08-2021 12:10

23-07-2021 13:10

Target

583ad904b51ce0851f9f2cb056a9a2e3.exe
Size

457KB
MD5

583ad904b51ce0851f9f2cb056a9a2e3
SHA1

daa33b986624b2156b336392c4d5cc1ddd184e56
SHA256

95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481
SHA512

ec96716efc1fe8662df5d9f0defa0f9d831a794d96bf8b5ad6c663395dd97c4127dbb4c1e8f73185a001722ef7861bedefda598df91739fd0a43ee05940d8f9c

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

description pid process target process

PID 3424 created 2764 3424 583ad904b51ce0851f9f2cb056a9a2e3.exe Explorer.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

pid process

3424 583ad904b51ce0851f9f2cb056a9a2e3.exe
3424 583ad904b51ce0851f9f2cb056a9a2e3.exe

description	pid	process	target process
PID 3424 created 2764	3424	583ad904b51ce0851f9f2cb056a9a2e3.exe	Explorer.EXE

pid	process
3424	583ad904b51ce0851f9f2cb056a9a2e3.exe
3424	583ad904b51ce0851f9f2cb056a9a2e3.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

583ad904b51ce0851f9f2cb056a9a2e3.exe

description	pid	process	target process
PID 3424 wrote to memory of 3664	3424	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe
PID 3424 wrote to memory of 3664	3424	583ad904b51ce0851f9f2cb056a9a2e3.exe	583ad904b51ce0851f9f2cb056a9a2e3.exe

C:\Users\Admin\AppData\Local\Temp\583ad904b51ce0851f9f2cb056a9a2e3.exe
C:\Users\Admin\AppData\Local\Temp\583ad904b51ce0851f9f2cb056a9a2e3.exe 1
2⤵
PID:3664

memory/3424-114-0x0000000140000000-0x0000000140069000-memory.dmp

Filesize
420KB

Download
memory/3424-121-0x0000000000480000-0x00000000004E5000-memory.dmp

Filesize
404KB

Download
memory/3664-120-0x0000000000000000-mapping.dmp

Download
memory/3664-128-0x00007FF84ECC0000-0x00007FF84ED6E000-memory.dmp

Filesize
696KB

Download
memory/3664-129-0x00007FF84E630000-0x00007FF84E6D1000-memory.dmp

Filesize
644KB

Download
memory/3664-130-0x00007FF84C000000-0x00007FF84C0A4000-memory.dmp

Filesize
656KB

Download
memory/3664-131-0x00007FF835A80000-0x00007FF835DAE000-memory.dmp

Filesize
3.2MB

Download
memory/3664-132-0x00007FF84DBA0000-0x00007FF84DC0C000-memory.dmp

Filesize
432KB

Download
memory/3664-133-0x00007FF84BFB0000-0x00007FF84BFE7000-memory.dmp

Filesize
220KB

Download
memory/3664-134-0x00007FF84CA10000-0x00007FF84CC59000-memory.dmp

Filesize
2.3MB

Download
memory/3664-135-0x0000000002B60000-0x0000000002BA0000-memory.dmp

Filesize
256KB

Download
memory/3664-136-0x0000000002BA0000-0x0000000002C25000-memory.dmp

Filesize
532KB

Download