cobaltstrike | 757ecb1a43db6d18e1c1797157cdb5253baeb32d8c94adae7b20bd5266ec1f9b | Triage

Analysis

max time kernel
27s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-09-2022 03:01

Sharing

Report Analysis Logs

General

Target

1b780b4355cccc3c0f850bba1486db1b.exe
Size

195KB
MD5

1b780b4355cccc3c0f850bba1486db1b
SHA1

65305aeacf482d9495b68eec61c1ef64e9b0446c
SHA256

757ecb1a43db6d18e1c1797157cdb5253baeb32d8c94adae7b20bd5266ec1f9b
SHA512

d440e834312704b65409f4f551d34f523009ad0a1371c3687c9f8e41a5aa30212a08a931161a6a1a2818ee3ed33f68c4fe0e272c232366f333f7dabd8c450654
SSDEEP

3072:dryEFdApaWVzPCWdEcCb6Xc8F9u7CC/CaFwT8FJ2AB2O9D5pZa9uD6Vdyhk7:FRFdAUEzPib4tF9EDCam2BXnwVf7

Score

10^/10

cobaltstrike metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

188.119.112.85:443

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

C:\Users\Admin\AppData\Local\Temp\1b780b4355cccc3c0f850bba1486db1b.exe
"C:\Users\Admin\AppData\Local\Temp\1b780b4355cccc3c0f850bba1486db1b.exe"
1⤵
PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-54-0x000000000061C000-0x000000000062C000-memory.dmp

Filesize
64KB

Download
memory/1848-55-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1848-56-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1848-57-0x0000000000290000-0x00000000002BB000-memory.dmp

Filesize
172KB

Download
memory/1848-58-0x00000000002C0000-0x00000000002F1000-memory.dmp

Filesize
196KB

Download
memory/1848-60-0x0000000002280000-0x0000000002380000-memory.dmp

Filesize
1024KB

Download
memory/1848-61-0x00000000004A0000-0x00000000004FF000-memory.dmp

Filesize
380KB

Download
memory/1848-62-0x000000000064C000-0x0000000000668000-memory.dmp

Filesize
112KB

Download
memory/1848-63-0x00000000003D0000-0x00000000003F0000-memory.dmp

Filesize
128KB

Download
memory/1848-64-0x000000000061C000-0x000000000062C000-memory.dmp

Filesize
64KB

Download
memory/1848-65-0x00000000002C0000-0x00000000002F1000-memory.dmp

Filesize
196KB

Download
memory/1848-66-0x0000000002280000-0x0000000002380000-memory.dmp

Filesize
1024KB

Download
memory/1848-67-0x00000000004A0000-0x00000000004FF000-memory.dmp

Filesize
380KB

Download