cobaltstrike | c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170

Analysis

max time kernel
285s
max time network
365s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:32

Target

c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170.exe
Size

76KB
MD5

b894b9f82c09d031790f80179d503774
SHA1

4a1cc069c04d4e4a8d14b184dbdde95831733174
SHA256

c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170
SHA512

81e37fce2753ab37dc23e3d1e4d41bf4ae9cc0c8ecc1755930cab20a18a5bd03340e166029fc1cb6c440bb681438c8bc6ab1627eb82c382808f41bc65813c5e3
SSDEEP

1536:S+won4kn8DkWEUcA6v0za1xWvE35hIjhwXy+edvAZqK8:S+bZWEUcAhhE30+WXL

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170.exe

pid	process
4548	c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170.exe
4548	c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170.exe

C:\Users\Admin\AppData\Local\Temp\c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170.exe
"C:\Users\Admin\AppData\Local\Temp\c498eb9ed0920a8f50c36a679bd22799b0797c73aad1df3a8ba43a013a7c6170.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4548

memory/4548-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4548-133-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/4548-137-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download