cobaltstrike | cb458362e56ace4b3f2859a2e340fa5afefcff4e46acff0ba5968a1d4c9e439e

Analysis

max time kernel
32s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-12-2022 06:46

Target

smss.dll
Size

470KB
MD5

67ad0d987d0847de43a3f4083e8b4dc0
SHA1

db2a488ba826af425f3eff0de6b33fba4ec56669
SHA256

cb458362e56ace4b3f2859a2e340fa5afefcff4e46acff0ba5968a1d4c9e439e
SHA512

c141b6de5f84557e9395d21217eba23f3c650c2ac63ae2d73e426244381276f65011abdd9bd47c796bfb69e4f1daa9d6b9d60f38ecd12fcef9dce796f95ee457
SSDEEP

3072:wMyoPVCZYukejYCzAAwsg5hf7bKF+Gwwwwwwwwwwww:ryWQauklCzApsYf7s+

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28
PID 2028 wrote to memory of 1716	2028	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\smss.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\smss.dll
  2⤵
  PID:1716

memory/1716-55-0x0000000000000000-mapping.dmp

Download
memory/1716-56-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1716-57-0x000000006BAC0000-0x000000006BB0D000-memory.dmp

Filesize
308KB

Download
memory/1716-67-0x0000000003110000-0x0000000003141000-memory.dmp

Filesize
196KB

Download
memory/1716-69-0x0000000003860000-0x0000000003C60000-memory.dmp

Filesize
4.0MB

Download
memory/1716-71-0x0000000003240000-0x000000000329F000-memory.dmp

Filesize
380KB

Download
memory/1716-76-0x0000000003660000-0x0000000003860000-memory.dmp

Filesize
2.0MB

Download
memory/1716-78-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/1716-82-0x0000000003660000-0x0000000003860000-memory.dmp

Filesize
2.0MB

Download
memory/1716-83-0x0000000003660000-0x0000000003860000-memory.dmp

Filesize
2.0MB

Download
memory/1716-84-0x0000000003660000-0x0000000003860000-memory.dmp

Filesize
2.0MB

Download
memory/2028-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download