cobaltstrike | a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a

Analysis

max time kernel
4s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 04:07

Target

a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe
Size

144KB
MD5

88d99ccb10be95f1299939b940a37ba8
SHA1

44fdee095c4aaa45424d668aa05e409122969226
SHA256

a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a
SHA512

5978bc76dc4bb33f2004ca215959c44a266b21efe9414ca0e5fa94701e6d2f5a6d08e8a9a9e749a616dd092501827704b1700dc3729a973fff9dabc7123b01a5
SSDEEP

3072:s0IYwk7xA1G2PDVlZ2ilhdh+ukIRObZzFpdXpaJx7vHUgrQs:nIYwkdQDVL2irv+UYbHZaz7MwQs

Score

10^/10

Family

pony

http://74.53.97.66:8080/forum/viewtopic.php

http://74.53.97.67:8080/forum/viewtopic.php

Attributes

payload_url
http://cef02guara.org.br/7fSos.exe
http://biskercentre.org/FEhyRBhG.exe
http://dimidi.com/QF3PgGLm.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe

description	pid	process	target process
PID 1992 wrote to memory of 2040	1992	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe
PID 1992 wrote to memory of 2040	1992	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe
PID 1992 wrote to memory of 2040	1992	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe
PID 1992 wrote to memory of 2040	1992	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe	a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe

C:\Users\Admin\AppData\Local\Temp\a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe
"C:\Users\Admin\AppData\Local\Temp\a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe
"C:\Users\Admin\AppData\Local\Temp\a8615395509dccd6a63fea9b0b5b4fc1ca2aca974aad2efb33e97842ec81325a.exe"
2⤵
PID:2040

memory/1992-54-0x00000000002E0000-0x000000000030F000-memory.dmp

Filesize
188KB

Download
memory/1992-55-0x00000000002E0000-0x000000000030F000-memory.dmp

Filesize
188KB

Download