cobaltstrike | 83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc

Analysis

Target
83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe
Size 1.7MB
Sample211022-jnpfsscbej
SHA256 83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc
MD5 1d7fa8815a5b11435b9aa0a851cfeeb2
SHA1 4bb3d31b1f49abd55f23c996be157cabb39771b9
SHA512 150acf82b8753cd08665c53a15b762cc8f4817e8e5ff461e07074157fc8d0c0316f278d6e298301b100308846a63abb15d23700522e7f0837a544a692cee6541
MD5 SHA1 SHA512

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4052	2856	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	70
PID 2856 wrote to memory of 4052	2856	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	70
PID 2856 wrote to memory of 4052	2856	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	70
PID 2856 wrote to memory of 4052	2856	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	70
PID 2856 wrote to memory of 4052	2856	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	70
PID 2856 wrote to memory of 4052	2856	83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe	70

C:\Users\Admin\AppData\Local\Temp\83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe
"C:\Users\Admin\AppData\Local\Temp\83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:4052

memory/2856-115-0x00007FFEC0510000-0x00007FFEC05BE000-memory.dmp

Download

memory/2856-116-0x00007FFEC0090000-0x00007FFEC02D9000-memory.dmp

Download

memory/2856-119-0x00007FFEC2DF0000-0x00007FFEC2FCB000-memory.dmp

Download

memory/4052-120-0x000001419AA60000-0x000001419AA61000-memory.dmp

Download