cobaltstrike | a85192827c39ca6bd5e1032b38f7fcded6c6294f32061c25015b282f5607c2e3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 09:42

Target

a85192827c39ca6bd5e1032b38f7fcded6c6294f32061c25015b282f5607c2e3.dll
Size

1.6MB
MD5

f4481157aa1d27dc6565f6ebe5e52342
SHA1

efc7600b0ec1ddc9b3e84bd95a5052a37ed3bf6b
SHA256

a85192827c39ca6bd5e1032b38f7fcded6c6294f32061c25015b282f5607c2e3
SHA512

0fb42cda2f6afb4324bde8d8e0872405496582259a3cbe67cb7c70f54ec0770e73890dd229e70010bb7fc43af63dbfe0a0b1a86cb72b00f19a06edb7a4bc148e
SSDEEP

12288:1HCLMyOgDFzNFmzJdjvi0TsvceUmhFg3vGebdjt5sCTe186cxi+oVvD+t4so3ujH:1VipzNFmzK0wHTg3+kjo1YjxJTiNwd

Score

10^/10

Family

cobaltstrike

http://192.168.190.138:80/OzPD

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3900	412	rundll32.exe	83
PID 412 wrote to memory of 3900	412	rundll32.exe	83
PID 412 wrote to memory of 3900	412	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a85192827c39ca6bd5e1032b38f7fcded6c6294f32061c25015b282f5607c2e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3900

memory/3900-0-0x0000024AA48C0000-0x0000024AA48C1000-memory.dmp

Filesize
4KB

Download