cobaltstrike | 580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736

Analysis

max time kernel
131s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/09/2024, 07:12

Target

580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe
Size

262KB
MD5

22db6458c458b402831e8b74621e8a1d
SHA1

d4f1438bc1d39eef7fe39bd9ee5e21e988930b1f
SHA256

580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736
SHA512

7291d1c9d25ae6ef0372dbec1e07fb742acc8e3ce0798161915c5bbe21c163684f02a7f070cde74b0e6d8fa63f99a6e1ab212e9dd8383f9f8080d2d487340c03
SSDEEP

6144:IIn0gFc1UIE1gt395GTe83dMNJJJ655ZZo9W+Kki:IIn0Ac1UIE1gt3Kv3p+K1

Score

10^/10

Family

cobaltstrike

http://state-mgmt.us:443/amJE

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2340	1920	580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe	32
PID 1920 wrote to memory of 2340	1920	580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe	32
PID 1920 wrote to memory of 2340	1920	580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe	32
PID 1920 wrote to memory of 2340	1920	580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe	32

C:\Users\Admin\AppData\Local\Temp\580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe
"C:\Users\Admin\AppData\Local\Temp\580809c7c05f1630c637690c41db2ddea7feb0e230bf92f51deebaa495b46736.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:2340

memory/1920-1-0x000000013F8E0000-0x000000013F92E000-memory.dmp

Filesize
312KB

Download
memory/2340-0-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download