cobaltstrike | 7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 15:10

Target

7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0.exe
Size

1.3MB
MD5

68d421e637be00f118edc6205518fc2c
SHA1

6eb14b1b6f85542b38e02fc15dd5020c48ffdd24
SHA256

7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0
SHA512

a6087976c2be1fe909646ed346a1f96a7f2463ee95ce7ccfb923c791804f3d6a430b74028e0db672e1dbd0bae390ff1e5bb7be09c19942146350ecf279ea3054
SSDEEP

12288:D3sXm99oq60jkgtuHeUIVJKoIIKfWbgbvRKW9zDeWTN7lDh1P:oyqq60jvKeF0fWbgbv4WYW57z1P

Score

10^/10

Family

cobaltstrike

http://167.71.215.63:443/1hJz

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 5 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3988	3980	7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0.exe	86
PID 3980 wrote to memory of 3988	3980	7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0.exe	86
PID 3980 wrote to memory of 3988	3980	7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0.exe	86

C:\Users\Admin\AppData\Local\Temp\7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0.exe
"C:\Users\Admin\AppData\Local\Temp\7c72e4793b2aa5407153b54b427040a466595a52d96f7a632523de23003c63d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Blocklisted process makes network request
  PID:3988

memory/3988-0-0x000001C066630000-0x000001C066631000-memory.dmp

Filesize
4KB

Download
memory/3988-4-0x000001C0687C0000-0x000001C068BC0000-memory.dmp

Filesize
4.0MB

Download
memory/3988-5-0x000001C068BC0000-0x000001C068C16000-memory.dmp

Filesize
344KB

Download
memory/3988-6-0x000001C068BC0000-0x000001C068C16000-memory.dmp

Filesize
344KB

Download