cobaltstrike | f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 13:58

Target

f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152.exe
Size

1.0MB
MD5

27da57ee434cf6c69bc7c6beea5944b4
SHA1

aae01efe2197124a58ce5d24a290a3ac5255f661
SHA256

f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152
SHA512

01c7369b7bf8311b6eeb1a1cb0042867456b960221f8ff2ea06ba8720fcab317657164c7ae2f744eeb1b6a0c54208b37a6e742772a0b6004d2bed2d16f2cddb4
SSDEEP

12288:fANgFSuTSRzGkAzqclqMBpma/cyxR0lg1xbD+SbDMz1A:Q/1RSkADlbxR0lg1xGSvMz1A

Score

10^/10

Family

cobaltstrike

http://157.245.59.80:443/fyE9

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 5 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4908	536	f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152.exe	83
PID 536 wrote to memory of 4908	536	f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152.exe	83
PID 536 wrote to memory of 4908	536	f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152.exe	83

C:\Users\Admin\AppData\Local\Temp\f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152.exe
"C:\Users\Admin\AppData\Local\Temp\f2c7edbcc0a2befd4cf637658ed4a173c93b9ddf5edd1a88ea3a8239f1f60152.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Blocklisted process makes network request
  PID:4908

memory/4908-0-0x000002850D040000-0x000002850D041000-memory.dmp

Filesize
4KB

Download
memory/4908-4-0x000002850F1D0000-0x000002850F5D0000-memory.dmp

Filesize
4.0MB

Download
memory/4908-5-0x000002850F5D0000-0x000002850F626000-memory.dmp

Filesize
344KB

Download
memory/4908-6-0x000002850F5D0000-0x000002850F626000-memory.dmp

Filesize
344KB

Download