cobaltstrike | a68837854bc0927a3f8ca64f8d0eb72ab34d09f0171e0a928455b65bfe607bde

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 03:16

Target

a68837854bc0927a3f8ca64f8d0eb72ab34d09f0171e0a928455b65bfe607bde.exe
Size

19KB
MD5

96942f9cb53ab55aaae7a47bfa43d716
SHA1

e0d693e4b4f2ae902473ab3c59375a7516899860
SHA256

a68837854bc0927a3f8ca64f8d0eb72ab34d09f0171e0a928455b65bfe607bde
SHA512

b017e729dc9c83f65552af4781e5b19bf1000dbd09d124dfaf868e86f9ce4ced99597baa4927d4595b63c6b6692e880641d86dce597fdbb0cd85610f3c6dccbe
SSDEEP

192:vV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2DRW9E8GWF8qa1Dojjgi:pqaCF31cix+Dc4zjdNFF46gi

Score

10^/10

Family

cobaltstrike

http://https://service-857wfm5q-1257064901.gz.apigw.tencentcs.com/release/:80/bootstrap-2.min.js

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\a68837854bc0927a3f8ca64f8d0eb72ab34d09f0171e0a928455b65bfe607bde.exe
"C:\Users\Admin\AppData\Local\Temp\a68837854bc0927a3f8ca64f8d0eb72ab34d09f0171e0a928455b65bfe607bde.exe"
1⤵
PID:1672

memory/1672-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download