cobaltstrike | 9a88bd7e3e20d7f5ef693f9f838c7277e9121aae3b5277d966cbf162bce345a8

Analysis

max time kernel
89s
max time network
92s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 01:00

Target

455381bfd322608f89657a5ce2d4875b3c1f7dacfecfea0dca33d7e82aa3c6bf.exe
Size

17KB
MD5

056b795d0b4e4d7a4fb23a2001dabe25
SHA1

3a7a771ea02cb9af9b8152dc8209b9b735056e01
SHA256

455381bfd322608f89657a5ce2d4875b3c1f7dacfecfea0dca33d7e82aa3c6bf
SHA512

df4170dfc909b0b6c26e27961a8bdf8cdec68ec07557d471c6dcd0463e0e3502f6515c612da52a205cb060d11f4d12dcd583d44f9effbc114204b84a2985ce1c
SSDEEP

192:6DMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4ZNPwzXlBUbOj6kxiY:6DMAoKz6WtKEj7aBDixzXlbAY

Score

10^/10

Family

cobaltstrike

http://120.25.236.78:44333/Irn4

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\455381bfd322608f89657a5ce2d4875b3c1f7dacfecfea0dca33d7e82aa3c6bf.exe
"C:\Users\Admin\AppData\Local\Temp\455381bfd322608f89657a5ce2d4875b3c1f7dacfecfea0dca33d7e82aa3c6bf.exe"
1⤵
PID:2008

memory/2008-54-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2008-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download