cobaltstrike | 17ae5a05fd1fe648ddd767e9d03ff5f3e085169c79bca6bec5991746e4734f95

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 18:20

Target

2023-08-23_9865fe282de45bd96d0eff05e080f5c3_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

9865fe282de45bd96d0eff05e080f5c3
SHA1

67a7ef0714611c2c9bdad40eab9bb1c8ff566693
SHA256

17ae5a05fd1fe648ddd767e9d03ff5f3e085169c79bca6bec5991746e4734f95
SHA512

7cec2553e73a3914886f6ca4fbca0f7fb91598963710000483b6bcac7d1823979b525a85582831587ac28ee887b04573a18a92e690d74e6d6fedb706ce416711
SSDEEP

6144:O443XR4S38CWBeBxi66thkbAzLks1YarGR8ej4rC5Jj:2MLMBIz+YLks1YarGR8PWj

Score

10^/10

Family

cobaltstrike

Botnet

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 1704	2840	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_9865fe282de45bd96d0eff05e080f5c3_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_9865fe282de45bd96d0eff05e080f5c3_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
PID:1704

memory/1704-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1704-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download