cobaltstrike | d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 15:05

Target

d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe
Size

423KB
MD5

0cbe5e9eb925650ae2637fc171770689
SHA1

a46309d54abddefc3e96ab8316c0dd3f853fa7a0
SHA256

d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea
SHA512

82f8b082842e0ac0e80ede8eec9eb76fbf865c33cfb4cd36ec26b4431835df5ac87378dba8192163a19a0844d9eb2f0341b56c573035ce97e7867ded168d6d19
SSDEEP

3072:146YJeQJxhAgvDtXlW6CoU7on12W4WQmg32hE0nuKo0Lrgu6cO4MQq3jq4FCgDjP:14HoWJDBlSCmj3jqUtbUilcAOPFs

Score

10^/10

Family

cobaltstrike

http://��/uGHX:808333358I��Ey�KI�纆M��

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe

description	pid	process	target process
PID 2220 wrote to memory of 2336	2220	d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe	WerFault.exe
PID 2220 wrote to memory of 2336	2220	d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe	WerFault.exe
PID 2220 wrote to memory of 2336	2220	d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe
"C:\Users\Admin\AppData\Local\Temp\d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2220 -s 112
2⤵
PID:2336

memory/2220-0-0x000000013F970000-0x000000013F9D3000-memory.dmp

Filesize
396KB

Download