cobaltstrike | 92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:21

Target

92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe
Size

144KB
MD5

e6b72ed2d3eeb2253f8bc0fce84b7183
SHA1

00c128accb19f52e36d21ced61309a602e55b471
SHA256

92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4
SHA512

d8efd5bae815cb83f9d6de5339a635794260da5f8be03251ceb6be2cc463e4cf9285cd40e14186ef63089f6397f328d30e15c3034f176d652c37705277f4a826
SSDEEP

3072:oDZaZeFbifra36ZbYNgLV3XJBbKuMHiJgpaJIK0rvox2qUQ:wgeYa3UbYuFPbUJaYrE

Score

10^/10

Family

pony

http://74.53.97.66:8080/forum/viewtopic.php

http://74.53.97.67:8080/forum/viewtopic.php

Attributes

payload_url
http://www.selfdefensesuperstore.com/ifWSX.exe

http://sierratroutmagnet.com/QkaK.exe

http://www.joserrago.com/WF2oWtq.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 952	996	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	27
PID 996 wrote to memory of 952	996	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	27
PID 996 wrote to memory of 952	996	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	27
PID 996 wrote to memory of 952	996	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	27

C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe
"C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe
  "C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe"
  2⤵
  PID:952

memory/996-54-0x00000000009E0000-0x0000000000A0F000-memory.dmp

Filesize
188KB

Download
memory/996-55-0x00000000009E0000-0x0000000000A0F000-memory.dmp

Filesize
188KB

Download