cobaltstrike | 61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf

Analysis

max time kernel
100s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 04:07

Target

61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe
Size

144KB
MD5

da02d6b381addbffa81aad15d0b6a05a
SHA1

0180b4bcd3803aa7196adaaef7c33f057fdebc03
SHA256

61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf
SHA512

1fbc09544ed85b484f9d435db92a9223b863ed1d667fb6c43b84670aa824e1ea7d205df2d4b8e60bdfb15e1c653a32438a444ebd9ccb73c270badb91dedd8960
SSDEEP

3072:s0IYwk7xA1PHbSnCZYoB1rLAxgutQb0HdUyY6CpaJFsZLoYHYd:nIYwkd8Sn8YoLLVrbwzuaj2rH0

Score

10^/10

Family

pony

http://74.53.97.66:8080/forum/viewtopic.php

http://74.53.97.67:8080/forum/viewtopic.php

Attributes

payload_url
http://orion.obidigital.net/d09ZhGf.exe
http://ftp.lastraautosport.com.ar/xjH.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe

description	pid	process	target process
PID 3796 wrote to memory of 1984	3796	61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe	61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe
PID 3796 wrote to memory of 1984	3796	61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe	61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe
PID 3796 wrote to memory of 1984	3796	61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe	61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe

C:\Users\Admin\AppData\Local\Temp\61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe
"C:\Users\Admin\AppData\Local\Temp\61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796

C:\Users\Admin\AppData\Local\Temp\61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe
"C:\Users\Admin\AppData\Local\Temp\61867e380f054db5c1d21aff69bf0c213d81503ef7a0d9817efba62f051115cf.exe"
2⤵
PID:1984

memory/1984-133-0x0000000000000000-mapping.dmp

Download
memory/3796-132-0x00000000009B0000-0x00000000009DF000-memory.dmp

Filesize
188KB

Download
memory/3796-134-0x00000000009B0000-0x00000000009DF000-memory.dmp

Filesize
188KB

Download