cobaltstrike | 92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4

Analysis

max time kernel
348s
max time network
388s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:21

Target

92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe
Size

144KB
MD5

e6b72ed2d3eeb2253f8bc0fce84b7183
SHA1

00c128accb19f52e36d21ced61309a602e55b471
SHA256

92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4
SHA512

d8efd5bae815cb83f9d6de5339a635794260da5f8be03251ceb6be2cc463e4cf9285cd40e14186ef63089f6397f328d30e15c3034f176d652c37705277f4a826
SSDEEP

3072:oDZaZeFbifra36ZbYNgLV3XJBbKuMHiJgpaJIK0rvox2qUQ:wgeYa3UbYuFPbUJaYrE

Score

10^/10

Family

pony

http://74.53.97.66:8080/forum/viewtopic.php

http://74.53.97.67:8080/forum/viewtopic.php

Attributes

payload_url
http://www.selfdefensesuperstore.com/ifWSX.exe

http://sierratroutmagnet.com/QkaK.exe

http://www.joserrago.com/WF2oWtq.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4372	3832	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	81
PID 3832 wrote to memory of 4372	3832	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	81
PID 3832 wrote to memory of 4372	3832	92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe	81

C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe
"C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe
  "C:\Users\Admin\AppData\Local\Temp\92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4.exe"
  2⤵
  PID:4372

memory/3832-132-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download
memory/3832-134-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download