cobaltstrike | 96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130

Analysis

max time kernel
72s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 16:56

Target

96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe
Size

152KB
MD5

bc516e2428b04e0e75230697d3dd87c0
SHA1

015f31469c48f269ca3c011833e87dbbcab6ee49
SHA256

96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130
SHA512

3cbed515238437058d1a7064f6a713b75c6cb09dc6f6033c32c084b78c227a0f1bae61e12a00414d636f9f38632cab783cd2ae0b48f33b84f2fe39575bd2e9be
SSDEEP

3072:vsM+xYtQ8CIcDO4ZTGv1RRy93nRd93eFTzZeSWijRN3CtGJ:ZRhCPO4ZTUAVVCzQdi9N3C

Score

10^/10

Family

pony

http://66.55.89.149:8080/forum/viewtopic.php

http://66.55.89.150:8080/forum/viewtopic.php

Attributes

payload_url
http://cikonungunlugu.com/CMw.exe
http://ftp.lastraautosport.com.ar/xjH.exe

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe

description	pid	process	target process
PID 1752 wrote to memory of 4900	1752	96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe	96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe
PID 1752 wrote to memory of 4900	1752	96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe	96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe
PID 1752 wrote to memory of 4900	1752	96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe	96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe

C:\Users\Admin\AppData\Local\Temp\96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe
"C:\Users\Admin\AppData\Local\Temp\96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe
"C:\Users\Admin\AppData\Local\Temp\96b6a2fd52420ce5603974686ac26fb00c6c008400f3837aa123fd05cc2ed130.exe"
2⤵
PID:4900

memory/1752-132-0x0000000000650000-0x0000000000682000-memory.dmp

Filesize
200KB

Download
memory/1752-134-0x0000000000650000-0x0000000000682000-memory.dmp

Filesize
200KB

Download
memory/4900-133-0x0000000000000000-mapping.dmp

Download