cobaltstrike | c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 19:27

Target

c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684.exe
Size

59KB
MD5

ecfa74da94938eb89e73d8a6efdc346d
SHA1

679763504fc96a346d8c32c9027335ca2b626981
SHA256

c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684
SHA512

98e6f938dd6f1347f1afe71692bc965bdc85899628b736906736d1051b7f61f9eece72942abcc0f818623315ab04c0d0f9f549119532036b1b832a12b4a2e504
SSDEEP

768:hhdfqt9PaM+OEO0NecSh0ntnsnP62UBLXm5P0QhDXhG/:xfqtOOEO0Noh0ntngi2Uch0QhDY/

Score

10^/10

Family

cobaltstrike

http://1.92.124.144:2345/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2488	2980	c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684.exe	31
PID 2980 wrote to memory of 2488	2980	c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684.exe	31
PID 2980 wrote to memory of 2488	2980	c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684.exe	31

C:\Users\Admin\AppData\Local\Temp\c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684.exe
"C:\Users\Admin\AppData\Local\Temp\c8d2c02398041f56deebd15ec039ed651c635dd35fff159cac28f7e671027684.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2980 -s 36
  2⤵
  PID:2488

memory/2980-0-0x000000013F940000-0x000000013F954000-memory.dmp

Filesize
80KB

Download