cobaltstrike | 386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:15

Target

386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe
Size

2.2MB
MD5

e099ab6a949a673b8bf449b1e5165e8c
SHA1

a0b74d87fbb3586141c2d234f8e0a85ccee2ca16
SHA256

386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7
SHA512

8f356e4591a308d2784675849ca9c9a6a9ac8093d83144045d04c07a3fb9b27497598176d74dec28eacff55aac89243b4d191bb84601cced750d306e909dc40c
SSDEEP

24576:t+Z15V4YN3l/xDhztXF/ZL5LtHdnRrFLh7dDR7N7xL1TBtjD594jRo+9UZEKckZX:45V9j3tllZ3hP1xI3S

Score

10^/10

Family

cobaltstrike

http://10.211.55.2:801/XXXXXX

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 7.1; Trident/5.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 848	4492	386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe	84
PID 4492 wrote to memory of 848	4492	386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe	84
PID 4492 wrote to memory of 848	4492	386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe	84
PID 4492 wrote to memory of 848	4492	386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe	84

C:\Users\Admin\AppData\Local\Temp\386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe
"C:\Users\Admin\AppData\Local\Temp\386fec1a13a453e49cd6f2727bb26444c4f03dbf10958bc80dda83f2b59a58f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:848

memory/848-0-0x000002305E230000-0x000002305E231000-memory.dmp

Filesize
4KB

Download