33df103c55960d05bbcfb3bef94d49873ed7bcc70797f59c89db3ca3b61ce4b6

Analysis

max time kernel
80s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2023, 06:52

Target

cobaltstrike.exe
Size

14KB
MD5

41bba35e6e53b8f7afadd757750a9e4e
SHA1

8699336039f3278fcfc05c80ab694cf05028a262
SHA256

33df103c55960d05bbcfb3bef94d49873ed7bcc70797f59c89db3ca3b61ce4b6
SHA512

399a52e4e880f4056f8a856745f8f52c71a0b0fdfdefc037a8d75bc2508063fd99fa465553e0e4d81932599797c2dcc5aa24dc931dc7c8fb5aeb7ec8ceadddaf
SSDEEP

192:nds61A/0LiQxqfKD6VkagfWhiQ7SMrZ0l96Sd/1CQzTQjcWHDS35cB+k:yx0iQxqslQmD9L/3fAzHDwcB+k

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 884	4428	cobaltstrike.exe	87
PID 4428 wrote to memory of 884	4428	cobaltstrike.exe	87
PID 4428 wrote to memory of 884	4428	cobaltstrike.exe	87
PID 884 wrote to memory of 3752	884	cmd.exe	89
PID 884 wrote to memory of 3752	884	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\cobaltstrike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c java -Dfile.encoding=utf-8 -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:hook.jar=5e98194a01c6b48fa582a6a9fcbb92d6 -Duser.language=en -jar cobaltstrike.jar
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\ProgramData\Oracle\Java\javapath\java.exe
    java -Dfile.encoding=utf-8 -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:hook.jar=5e98194a01c6b48fa582a6a9fcbb92d6 -Duser.language=en -jar cobaltstrike.jar
    3⤵
    PID:3752

memory/4428-133-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download