cobaltstrike | fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 22:25

Target
fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40.exe
Size 3.9MB
Sample240630-2cefka1bqq
SHA256 fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40
MD5 e26e9b23b2ea96a9d90c1147bf734d6e
SHA1 7e9012c720af638ef89492fd40d04d616389a6cc
SHA512 a1ae541c767e82139fa6f271cfcaf2ff6098786fd940a2c0c2d6b17121351d35d84bbc27a5d3894856b6245b168e81d87023abf9c974bca90e392d9b3d11f9f3
SSDEEP 49152:5zxiTbnyz0xvZF8NRd7tQJnGh83usTCj4H2:uyzMF8q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; LBBROWSER)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1908	2976	fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40.exe	82
PID 2976 wrote to memory of 1908	2976	fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40.exe	82

C:\Users\Admin\AppData\Local\Temp\fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40.exe
"C:\Users\Admin\AppData\Local\Temp\fee53401177b72bfcf5ccdad590fe5f194b25e4e77ba9e95e6d26fcc4c996e40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:1908

memory/2976-1-0x0000025B7A100000-0x0000025B7A101000-memory.dmp

Download

memory/2976-0-0x00007FFCD9050000-0x00007FFCD9245000-memory.dmp

Download