cobaltstrike | e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e

Analysis

Target

e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e.exe
Size

252KB
MD5

ba170b8e67894178b768b38bce05bfb5
SHA1

c0cd01af7e9876f060b292cc595894705dbb2ff7
SHA256

e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e
SHA512

81a1b0c7a6596761ab106c390df9dc182aa0a6454198ed9c473c9b443514c0c1ab9c3f23d03ce51aac4c609ceaa2f8325e5208ad014e9dd8d62fd4406b0f85ba

Score

10^/10

Family

cobaltstrike

Botnet

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata: ET MALWARE Cobalt Strike Beacon Observed
suricata
suricata: ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1
suricata: ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1
suricata
Executes dropped EXE 1 IoCs

Processes:

winsver.exe

pid process

4572 winsver.exe

pid	process
4572	winsver.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e.exe

description	pid	process	target process
PID 2672 wrote to memory of 4572	2672	e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e.exe	winsver.exe
PID 2672 wrote to memory of 4572	2672	e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e.exe	winsver.exe

C:\Users\Admin\AppData\Local\Temp\e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e.exe
"C:\Users\Admin\AppData\Local\Temp\e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Public\winsver.exe
"C:\Users\Public\winsver.exe"
2⤵
- Executes dropped EXE
PID:4572

C:\Users\Public\winsver.exe
Filesize
252KB

MD5
ba170b8e67894178b768b38bce05bfb5

SHA1
c0cd01af7e9876f060b292cc595894705dbb2ff7

SHA256
e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e

SHA512
81a1b0c7a6596761ab106c390df9dc182aa0a6454198ed9c473c9b443514c0c1ab9c3f23d03ce51aac4c609ceaa2f8325e5208ad014e9dd8d62fd4406b0f85ba

Download Submit
C:\Users\Public\winsver.exe
Filesize
252KB

MD5
ba170b8e67894178b768b38bce05bfb5

SHA1
c0cd01af7e9876f060b292cc595894705dbb2ff7

SHA256
e29626e9cf755cc084adf9c08b0f6fd5750d86f5cfe580ca971c29c0110f590e

SHA512
81a1b0c7a6596761ab106c390df9dc182aa0a6454198ed9c473c9b443514c0c1ab9c3f23d03ce51aac4c609ceaa2f8325e5208ad014e9dd8d62fd4406b0f85ba

Download Submit
memory/4572-130-0x0000000000000000-mapping.dmp

Download
memory/4572-133-0x000002321A510000-0x000002321A910000-memory.dmp

Filesize
4.0MB

Download
memory/4572-134-0x000002321A910000-0x000002321A95C000-memory.dmp

Filesize
304KB

Download