cobaltstrike | 1708-54-0x0000000000100000-0x0000000000152000-memory[.]dmp | Triage

Sharing

General

Target

1708-54-0x0000000000100000-0x0000000000152000-memory.dmp
Size

328KB
MD5

40a6c80e31df7fc9bcc751f2c29ce526
SHA1

9660a8e2168fc784d24db85e2fcad902fd1e7263
SHA256

d999831510b3473158ab61239b12d891640ae2106aba994846fc885bd92b2485
SHA512

b6b9207aa7aa860b604421e8f1732b704239148c67b0d4dac59dff86dda35e0a4e0e3219db7ad435cdadfe766f32d2731030572745f5cb0f3e662ca54ce1b824
SSDEEP

3072:XzbINhWl+CIbrqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnLllMtuYJj6vzHk:XzbUyootfDCvT4ZTXzCLeud

Score

10^/10

0 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1708-54-0x0000000000100000-0x0000000000152000-memory.dmp

Files

1708-54-0x0000000000100000-0x0000000000152000-memory.dmp
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ