cobaltstrike | 0b36a30637adb49d6f710d7f87bec6b58f3e25544ef78f4d3f8403f833d60333

Analysis

max time kernel
629s
max time network
632s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 00:55

Target

tmptxouzz98.exe
Size

2.2MB
MD5

0143e9deba44b3da7afc333e33eeff19
SHA1

b2e8647ed1adddb20223f236c90b4cf1f968958b
SHA256

0b36a30637adb49d6f710d7f87bec6b58f3e25544ef78f4d3f8403f833d60333
SHA512

6986dae496b607974f8e76008fb3c02841b242903fcc4e11683fd3169bcb2556ba8b9ef905a13ebac0edeaf70b8dfc3dd553b64b60ae8fbabb9bd6a14cd7ec92
SSDEEP

24576:1BLauedc3tswowUD4zCi4NgPoCMSNcKVRfDREkhKryEcFICRqkMEqZqrU2no6987:Daj2LRE6vQyt1DA9E

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4968	4564	tmptxouzz98.exe	85
PID 4564 wrote to memory of 4968	4564	tmptxouzz98.exe	85

C:\Users\Admin\AppData\Local\Temp\tmptxouzz98.exe
"C:\Users\Admin\AppData\Local\Temp\tmptxouzz98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4968

memory/4564-132-0x00000130408B0000-0x00000130408F4000-memory.dmp

Filesize
272KB

Download
memory/4564-133-0x000001305AAA0000-0x000001305AF12000-memory.dmp

Filesize
4.4MB

Download
memory/4564-134-0x00007FFD9C550000-0x00007FFD9C745000-memory.dmp

Filesize
2.0MB

Download
memory/4564-135-0x00007FFD7DA40000-0x00007FFD7E501000-memory.dmp

Filesize
10.8MB

Download
memory/4564-136-0x00007FFD9C550000-0x00007FFD9C745000-memory.dmp

Filesize
2.0MB

Download
memory/4564-137-0x00007FFD7DA40000-0x00007FFD7E501000-memory.dmp

Filesize
10.8MB

Download