Analysis
-
max time kernel
148s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 21:16
Behavioral task
behavioral1
Sample
5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
Resource
win7-20220812-en
General
-
Target
5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
-
Size
114KB
-
MD5
33e11ed8831e47a93a1f8ce972d8d262
-
SHA1
97fdd00434c5fc821f6ef6fbb7bbd41de3bc4f62
-
SHA256
5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f
-
SHA512
dd0d48e1ac98bc15cfd254a497cae247d9d24eca3634ff7935b65c31520abebb17d8fe80e602d27a6c3c17f26c3d14b1287a98936f5a18bf127748c4148aa241
-
SSDEEP
3072:/XAtWYKBlViw1GBcMc0ToVAD6moAiOkj2Xa7UK9:fAoYKXViwcjc01d4y
Malware Config
Extracted
pony
http://etsiunjour.fr:81/pony/gate.php
http://66.175.217.203/pony/gate.php
-
payload_url
http://www.nipbr.com/Macs.exe
http://propasmanagement.com/qTNc.exe
http://officialhurricanesurvivalkits.com/aHU.exe
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exedescription pid process target process PID 4184 wrote to memory of 3376 4184 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe PID 4184 wrote to memory of 3376 4184 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe PID 4184 wrote to memory of 3376 4184 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe 5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe"C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe"C:\Users\Admin\AppData\Local\Temp\5fe4f51d4981761f8f5a526c103e7808059a3af983142773ffb6599c84398d3f.exe"2⤵