cobaltstrike | 77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/06/2023, 12:13

Target

77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe
Size

315KB
MD5

cf0bb5a0bc59a0d74bc7eacfdfaa6657
SHA1

88ae51aff13f4aedc28a5ec0fa52b4d299d1d45e
SHA256

77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf
SHA512

1184d52f02f4042547a18a2db785cf63700267bf08a6dfe4540ebbd4c55b4197bd233d7c2c7a3a34c8a8bdab18d0fbe896229979020aff99962b3c95da9927d4
SSDEEP

3072:xFEUOdh/LBNnx3kIxiduqPAWbfFY0P7doHsFw:xF3Odh/LBNnx9iTAOnTdoMF

Score

10^/10

Family

cobaltstrike

http://172.20.50.117:443/webassets/visitorAPI-idsync.js

Attributes

user_agent
Accept: */* Accept-Language: zh-CN,zh;q=0.9 Host: eduv2.msftedu.com Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br sec-ch-ua: Google Chrome";v="111", "Not(A:Brand";v="8", "Chromium";v="111 User-Agent: user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	1276	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1428	1276	77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe	28
PID 1276 wrote to memory of 1428	1276	77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe	28
PID 1276 wrote to memory of 1428	1276	77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe	28
PID 1276 wrote to memory of 1428	1276	77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe	28

C:\Users\Admin\AppData\Local\Temp\77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe
"C:\Users\Admin\AppData\Local\Temp\77c037c3ab7755ee2e4fcfeea207d6086e25a5c0b57b15f98ea7f1251f888acf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 96
  2⤵
  - Program crash
  PID:1428

memory/1276-54-0x0000000000910000-0x0000000000A11000-memory.dmp

Filesize
1.0MB

Download