cobaltstrike | 83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc

Analysis

Target
83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe
Size 1.7MB
Sample211022-jnpfsscbej
SHA256 83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc
MD5 1d7fa8815a5b11435b9aa0a851cfeeb2
SHA1 4bb3d31b1f49abd55f23c996be157cabb39771b9
SHA512 150acf82b8753cd08665c53a15b762cc8f4817e8e5ff461e07074157fc8d0c0316f278d6e298301b100308846a63abb15d23700522e7f0837a544a692cee6541
MD5 SHA1 SHA512

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 760	1728	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	28
PID 1728 wrote to memory of 760	1728	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	28
PID 1728 wrote to memory of 760	1728	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	28
PID 1728 wrote to memory of 760	1728	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	28
PID 1728 wrote to memory of 760	1728	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	28
PID 1728 wrote to memory of 760	1728	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	28

C:\Users\Admin\AppData\Local\Temp\83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe
"C:\Users\Admin\AppData\Local\Temp\83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:760

memory/760-56-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Download

memory/760-57-0x0000000077540000-0x00000000776E9000-memory.dmp

Download

memory/760-58-0x000007FEFD680000-0x000007FEFD6EC000-memory.dmp

Download

memory/760-59-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download