cobaltstrike | 78ce677ce507287c88c9dad11b4c4f04c144a63b4459bd1e7f20fc675956355d

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 17:23

Target

78ce677ce507287c88c9dad11b4c4f04c144a63b4459bd1e7f20fc675956355d.exe
Size

19KB
MD5

771187726578047b623b6a966a8582c6
SHA1

b201e91461bb482edd03d8f978486147feb3f429
SHA256

78ce677ce507287c88c9dad11b4c4f04c144a63b4459bd1e7f20fc675956355d
SHA512

4add31e905288fb193eccb3090c67fd7fa858afa71f54221b02e50345aca41a74b225548a50bd271f3941dd931e38c7b94bf128328d51ea73987f662fc26c35e
SSDEEP

192:eV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/26EWF8qa1Dojjgi:oqaCF31cix+Dc4zjVxFF46gi

Score

10^/10

Family

cobaltstrike

http://192.168.1.147:6443/er9M

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\78ce677ce507287c88c9dad11b4c4f04c144a63b4459bd1e7f20fc675956355d.exe
"C:\Users\Admin\AppData\Local\Temp\78ce677ce507287c88c9dad11b4c4f04c144a63b4459bd1e7f20fc675956355d.exe"
1⤵
PID:2012

memory/2012-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2012-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download