cobaltstrike | 89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8

Analysis

max time kernel
29s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:59

Target

89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe
Size

72KB
MD5

e539eff325e6589cc72c82f4d6f8b9c0
SHA1

00838afcb1615a52d64a8e02785de6a16532efe5
SHA256

89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8
SHA512

9b0311595b7a57e8992854c2fb9ef86a1789761053d3e064b5b965bce63b346b6e9a37ea9ef4750c806f3774cebadc4aaa1f215b85451bf48d4e5ab7ac22acb2
SSDEEP

1536:S+won4kYqDhPGGVXfC8xPklyHN+ul2tnvYozU:S+bFDhPGG08GbuMb

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe

pid	process
112	89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe
112	89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe

C:\Users\Admin\AppData\Local\Temp\89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe
"C:\Users\Admin\AppData\Local\Temp\89a0c9e9516760e6c98fef356f0e7bbd42422a85828038b8d05cc6545275d5a8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:112

memory/112-55-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/112-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/112-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/112-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download