cobaltstrike | 4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24

General

Target

4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe
Size

830KB
MD5

8f4aa27d4f7adf1dba54fda189c7dc5a
SHA1

dd2175073484a08d74a950f4c3e7f024843b46e7
SHA256

4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24
SHA512

7eba97cd52b970b243f352dbc0862441c6bd2f705347d196d56f9c27cdced2a73157237b2d27c6047ecd34fb90029e95f5420d6bb2cc20d76aee31af07f37b68
SSDEEP

12288:H9AJkL2RteaZhiIEvPkmzxpzdMeDSPtJyVUD10vrx/:HaJkLCA4uH5l/+JyK2R

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://:0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe

description	pid	process	target process
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe
PID 2000 wrote to memory of 1952	2000	4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe
"C:\Users\Admin\AppData\Local\Temp\4dcf71294c2eac9daea67264934f4bc2842809cea249d3aae052290a2f656c24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\System32\notepad.exe
C:\Windows\System32\notepad.exe
2⤵
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-57-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-59-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-67-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-73-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-76-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-81-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-86-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-92-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-94-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-96-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-95-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-98-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-104-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-108-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-113-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-117-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-116-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-115-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-114-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-112-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-111-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-110-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-109-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-107-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-106-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-105-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-103-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-102-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-101-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-100-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-99-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-97-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-93-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-91-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-90-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-89-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-88-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-87-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-85-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-84-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-83-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-82-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-80-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-79-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-78-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-75-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-74-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-72-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-71-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-70-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-69-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-68-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-66-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-65-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-64-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-63-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-62-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-61-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-60-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-58-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-56-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-55-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download
memory/1952-54-0x0000000000060000-0x00000000000A1000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads