cobaltstrike | a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 20:06

Target
a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.exe
Size 798KB
Sample240724-yvebqsxeph
SHA256 a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4
MD5 999091666dbf12a924835e3720ebec86
SHA1 9491aad3811e00ddf091722397e2506d24fd6946
SHA512 05cb1122bc8ec505fd67e9a19eab34404ac872217f21b61266a5ead09b605d9b9dbd719baa8c3c502a92ab4b12275b5f4dabe92e775bc6fedd7bec40d0a10461
SSDEEP 6144:YtqXvTUgaSp+vn8A7NFEooGkvgvGeLaAibwzo9lvKkkKz1eWDwCErbkxYMCrYOPp:8qfTbmn8yNFESk4vZ412tPoTPeb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

user_agent
Host: www.bilibili.com Accept: application/xml;q=0.9,image/avif,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Cookie: token=TYGAelr7Vs8pYUEdf0pAKVf6BcqFCOPB;BIGipServerpool_9.29_5229=3314783417.22012.0000 User-Agent: Microsoft-CryptoAPI/10.0

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.exe
2064	a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3052	2064	a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.exe	30
PID 2064 wrote to memory of 3052	2064	a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.exe	30
PID 2064 wrote to memory of 3052	2064	a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.exe	30
PID 3052 wrote to memory of 2400	3052	write.exe	31
PID 3052 wrote to memory of 2400	3052	write.exe	31
PID 3052 wrote to memory of 2400	3052	write.exe	31

a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.doc

Path C:\Users\Admin\AppData\Local\Temp\a9579b5d3ba68d169058d43b9b9d033897d2e51aceb26f76aa2a250ca337b4e4.doc
Size 217KB
SHA256 7542ae395c8fc53f549c58d3a63fdf7edd821fe1f41b0fcf3efd80716fe66e5b
MD5 4630744b49dab4fe858613dfdeff8b36
SHA1 7ec02d7e66827c64d2b3ee1354b10367d4c3f507
SHA512 f50cfb07da7f666e9b13734b75a0e4abb8d13072b051970bd27590fa9cfc6553466b63647990ced909b27302b5aa6591e4fe37e1306cca9fa3d0e71911cd9d7d
SSDEEP 768:KzCWCzTWnRUGWHImqXsOxX0BD87PA3q8Xo5kf0m0ALbMnjCsX0BD87PAaX0BD87d:KbRPWt0lpt5Um3M7uRZR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2064-1-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download