cobaltstrike | 4e7a06b20666a62613cca9f75ae58a35cfc5d721c05c8b435170a4e8024ba87e

Resubmissions

20-07-2023 06:12

07-12-2022 01:02

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2023 06:12

Target

/ƹרԱ- -ϴѧ.exe
Size

97KB
MD5

b2a2f21647de829af536ae7b52ee9be9
SHA1

013f65f5f82b9dd07b9cc1e1245194ce73d95fcf
SHA256

9643444b80f6f6172ff0bd830a46ed56d9de1033d5452336be2b5b9d42a35037
SHA512

a95110bd1c3e764a753986476cfd7c11e5fe45b6f8f87f5b42b9e79084535abad9d5c072885f827e6fe61201723e84e832b924d22786f8ff3c65a7b8b3fde7d6
SSDEEP

1536:CLT11uyRFNsa9N/urOKwjAEHxPNgE71R48suYjsW4dVRRD7XDXzZ:2TzuyRFNN9N/wwjtHxv+uYsVRJTbt

Score

10^/10

Family

cobaltstrike

http://service-5r35x0x0-1310046338.gz.apigw.tencentcs.com:443/result_78adc45.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3804 3892 WerFault.exe taskhostw.exe
4796 1976 WerFault.exe taskhostw.exe

pid	pid_target	process	target process
3804	3892	WerFault.exe	taskhostw.exe
4796	1976	WerFault.exe	taskhostw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ƹרԱ- -ϴѧ.exe

description	pid	process	target process
PID 1852 wrote to memory of 1976	1852	ƹרԱ- -ϴѧ.exe	taskhostw.exe
PID 1852 wrote to memory of 1976	1852	ƹרԱ- -ϴѧ.exe	taskhostw.exe
PID 1852 wrote to memory of 1976	1852	ƹרԱ- -ϴѧ.exe	taskhostw.exe
PID 1852 wrote to memory of 3892	1852	ƹרԱ- -ϴѧ.exe	taskhostw.exe
PID 1852 wrote to memory of 3892	1852	ƹרԱ- -ϴѧ.exe	taskhostw.exe
PID 1852 wrote to memory of 3892	1852	ƹרԱ- -ϴѧ.exe	taskhostw.exe

C:\Users\Admin\AppData\Local\Temp\\ƹרԱ- -ϴѧ.exe
"C:\Users\Admin\AppData\Local\Temp\\ƹרԱ- -ϴѧ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\System32\taskhostw.exe
"C:\Windows\System32\taskhostw.exe"
2⤵
PID:1976

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1976 -s 1132
3⤵
- Program crash
PID:4796

C:\Windows\System32\taskhostw.exe
"C:\Windows\System32\taskhostw.exe"
2⤵
PID:3892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3892 -s 1100
3⤵
- Program crash
PID:3804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 1976 -ip 1976
1⤵
PID:3684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 3892 -ip 3892
1⤵
PID:4784

memory/3892-133-0x0000021F55AA0000-0x0000021F55AA1000-memory.dmp

Filesize
4KB

Download