cobaltstrike | 794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155

Analysis

max time kernel
203s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 04:07

Target

794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe
Size

143KB
MD5

e5394b52e97873cac4c9df8cc543ef57
SHA1

424dc323639f1fd6ba798f6f16dbe46261b9c041
SHA256

794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155
SHA512

ef4c77ca4f7235d0e28d9fbe8b5101f89ff76fef7b11e757ebc46ec45e25f3e7c0991b92be528b6ac592f8a583e4652549c8c9c44089a8fbc795478943777020
SSDEEP

3072:XjlKZelTDxfra36ZbYNgLV3XJBbKuMHiJOpaJtK0rvox2qUQ:Jwelxa3UbYuFPbUPatrE

Score

10^/10

Family

pony

http://66.55.89.150:8080/forum/viewtopic.php

http://66.55.89.151:8080/forum/viewtopic.php

Attributes

payload_url
http://www.impresabonincontro.it/5vEv8Q.exe
http://ftp.groar.com.br/KUTS0Kc.exe
http://www.astrologiamilano.it/R8sY.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe

description	pid	process	target process
PID 2040 wrote to memory of 3136	2040	794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe	794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe
PID 2040 wrote to memory of 3136	2040	794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe	794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe
PID 2040 wrote to memory of 3136	2040	794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe	794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe

C:\Users\Admin\AppData\Local\Temp\794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe
"C:\Users\Admin\AppData\Local\Temp\794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe
"C:\Users\Admin\AppData\Local\Temp\794ff495e4754c70b71182011fefffc67c8bc25694f46d3912444127d1870155.exe"
2⤵
PID:3136

memory/2040-132-0x0000000000CA0000-0x0000000000CCF000-memory.dmp

Filesize
188KB

Download
memory/2040-134-0x0000000000CA0000-0x0000000000CCF000-memory.dmp

Filesize
188KB

Download
memory/3136-133-0x0000000000000000-mapping.dmp

Download