cobaltstrike | 816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 07:03

Target
816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8.exe
Size 2.5MB
Sample240825-hvpjpsshkq
SHA256 816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8
MD5 3ed326e4d1415ca66806b43e0dd710f3
SHA1 62af7c29a280be9e14b23a416d7f2a16499cf19b
SHA512 883149403b7f909bc7883992c29cd48cd44f171ab25b5d9385ba21d9c25450eaba4f5b8dac2b3a303c0bcb607d4ef9188105c045b4ba514cd2140cab1a58318b
SSDEEP 49152:EcRD0LfcT8yjOORCJuy+T/pq281dkbR0NjO03/suBcNMc71:Ev+Ls28Tk0E0NBbc7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 5088	3428	816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8.exe	85
PID 3428 wrote to memory of 5088	3428	816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8.exe	85
PID 3428 wrote to memory of 5088	3428	816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8.exe	85

C:\Users\Admin\AppData\Local\Temp\816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8.exe
"C:\Users\Admin\AppData\Local\Temp\816354c84c94c00839feaac418ac095b8d4515b75bd64e20df4ec48ca04a85e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5088