cobaltstrike | 00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 01:40

Target

00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
Size

144KB
MD5

6354f8babfca537c94e4b9111d5b16f0
SHA1

3f311aec0a70466860bc0a704e252743c27f19d6
SHA256

00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08
SHA512

bcc5fb5d1f5d0cc79b0a75713823c18843a197edb0b5d850b5b081f0618d027544c9aea9cada61e2574ae1f000c175b37472e7f4a4bcde30e799c95d0b320117
SSDEEP

3072:0jlKZelTDnInRZfZ+patRDUgO4Ryb3nqbttfpaJCa18E:4welkRZR+gtWU0bXOxah

Score

10^/10

Family

pony

http://74.53.97.66:8080/forum/viewtopic.php

http://74.53.97.67:8080/forum/viewtopic.php

Attributes

payload_url
http://www.obvjutphaas.nl/wQ7T.exe
http://r555.info/41LMMbt5.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe

description	pid	process	target process
PID 832 wrote to memory of 1376	832	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
PID 832 wrote to memory of 1376	832	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
PID 832 wrote to memory of 1376	832	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
PID 832 wrote to memory of 1376	832	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe	00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe

C:\Users\Admin\AppData\Local\Temp\00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
"C:\Users\Admin\AppData\Local\Temp\00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Local\Temp\00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
"C:\Users\Admin\AppData\Local\Temp\00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe"
2⤵
PID:1376

memory/832-54-0x00000000012B0000-0x00000000012DF000-memory.dmp

Filesize
188KB

Download
memory/832-55-0x00000000012B0000-0x00000000012DF000-memory.dmp

Filesize
188KB

Download