cobaltstrike | ee17c806a1c41f64ab9b68bbdab802c06a9da8890afb5cea2f66b544b88eaed9

Analysis

max time kernel
115s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 08:54

Target

Downloads/7880a7beae205f43c9f2155785b7959e.exe
Size

512KB
MD5

7880a7beae205f43c9f2155785b7959e
SHA1

10db7bfee04e2e7ecded0349f1caa169349f435a
SHA256

9b2b7f78b09504e244fa739d42c5a25e3e46171546ff973ac7179b11e66f3f75
SHA512

5a23b5501e16898a56017073901c7ef16497eca0b5787f736a1792646559c8626fa27746a0bc50ef6a30bf682c3eefa6c7c93b998a5542460e46da6e645df3d1
SSDEEP

3072:+ysn55wQ75zDUMqskcS2lxMtQpVpe9cEpt6kKdB:jaXL5fUjsrLlejcEptXA

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7880a7beae205f43c9f2155785b7959e.exe

pid process

4056 7880a7beae205f43c9f2155785b7959e.exe
4056 7880a7beae205f43c9f2155785b7959e.exe

pid	process
4056	7880a7beae205f43c9f2155785b7959e.exe
4056	7880a7beae205f43c9f2155785b7959e.exe

C:\Users\Admin\AppData\Local\Temp\Downloads\7880a7beae205f43c9f2155785b7959e.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads\7880a7beae205f43c9f2155785b7959e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4056

memory/4056-134-0x0000000000600000-0x000000000067D000-memory.dmp

Filesize
500KB

Download