cobaltstrike | 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f

Analysis

max time kernel
148s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:16

Target

5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
Size

114KB
MD5

33e11ed8831e47a93a1f8ce972d8d262
SHA1

97fdd00434c5fc821f6ef6fbb7bbd41de3bc4f62
SHA256

5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f
SHA512

dd0d48e1ac98bc15cfd254a497cae247d9d24eca3634ff7935b65c31520abebb17d8fe80e602d27a6c3c17f26c3d14b1287a98936f5a18bf127748c4148aa241
SSDEEP

3072:/XAtWYKBlViw1GBcMc0ToVAD6moAiOkj2Xa7UK9:fAoYKXViwcjc01d4y

Score

10^/10

Family

pony

http://etsiunjour.fr:81/pony/gate.php

http://66.175.217.203/pony/gate.php

Attributes

payload_url
http://www.nipbr.com/Macs.exe
http://propasmanagement.com/qTNc.exe
http://officialhurricanesurvivalkits.com/aHU.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe

description	pid	process	target process
PID 4184 wrote to memory of 3376	4184	5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe	5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
PID 4184 wrote to memory of 3376	4184	5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe	5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
PID 4184 wrote to memory of 3376	4184	5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe	5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe

C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
"C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
"C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe"
2⤵
PID:3376

memory/3376-133-0x0000000000000000-mapping.dmp

Download
memory/4184-132-0x0000000000800000-0x000000000081F000-memory.dmp

Filesize
124KB

Download
memory/4184-134-0x0000000000800000-0x000000000081F000-memory.dmp

Filesize
124KB

Download