33df103c55960d05bbcfb3bef94d49873ed7bcc70797f59c89db3ca3b61ce4b6 | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:42

Sharing

Report Analysis Logs

General

Target

cobaltstrike.exe
Size

14KB
MD5

41bba35e6e53b8f7afadd757750a9e4e
SHA1

8699336039f3278fcfc05c80ab694cf05028a262
SHA256

33df103c55960d05bbcfb3bef94d49873ed7bcc70797f59c89db3ca3b61ce4b6
SHA512

399a52e4e880f4056f8a856745f8f52c71a0b0fdfdefc037a8d75bc2508063fd99fa465553e0e4d81932599797c2dcc5aa24dc931dc7c8fb5aeb7ec8ceadddaf
SSDEEP

192:nds61A/0LiQxqfKD6VkagfWhiQ7SMrZ0l96Sd/1CQzTQjcWHDS35cB+k:yx0iQxqslQmD9L/3fAzHDwcB+k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2464	2028	cobaltstrike.exe	28
PID 2028 wrote to memory of 2464	2028	cobaltstrike.exe	28
PID 2028 wrote to memory of 2464	2028	cobaltstrike.exe	28
PID 2028 wrote to memory of 2464	2028	cobaltstrike.exe	28

C:\Users\Admin\AppData\Local\Temp\cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\cobaltstrike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c java -Dfile.encoding=utf-8 -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:hook.jar=5e98194a01c6b48fa582a6a9fcbb92d6 -Duser.language=en -jar cobaltstrike.jar
  2⤵
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download