cobaltstrike | 293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 13:58

Target

293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
Size

147KB
MD5

63b0740a005dfde4922a4e3989dad369
SHA1

41113dea2b51234439f20a0e8f80365e5c001d12
SHA256

293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496
SHA512

6b0cffd5a8f214b73b4f59123a7b1752956e592882db1ffb00449203f8ff21fe1c49ddc242975204fdd066a130db94f6aa08379953b52a9ae329337c0309c7d7
SSDEEP

3072:bzxiBaeYkkiOK2HPFPwKZqhUV4+ODiqwUXZ5ZvOv/E:h6u7P3Zqz+WX7ZmU

Score

10^/10

Family

pony

http://66.55.89.148:8080/forum/viewtopic.php

http://66.55.89.149:8080/forum/viewtopic.php

Attributes

payload_url
http://michielvanoppen.nl/ZqW3dBoV/efoa.exe

http://www.membershipmojo.com/eBw0AYLP/JNa4.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe

description	pid	process	target process
PID 1416 wrote to memory of 900	1416	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
PID 1416 wrote to memory of 900	1416	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
PID 1416 wrote to memory of 900	1416	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
PID 1416 wrote to memory of 900	1416	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe	293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe

C:\Users\Admin\AppData\Local\Temp\293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
"C:\Users\Admin\AppData\Local\Temp\293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
"C:\Users\Admin\AppData\Local\Temp\293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe"
2⤵
PID:900

memory/1416-54-0x00000000002A0000-0x00000000002D1000-memory.dmp

Filesize
196KB

Download
memory/1416-55-0x00000000002A0000-0x00000000002D1000-memory.dmp

Filesize
196KB

Download