cobaltstrike | 2ff63e6c2d8b9221194d784a6493fc335498ee7ab70c85bf363d46f8f8b0ff66 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 08:03

Sharing

Report Analysis Logs

General

Target

444.exe
Size

1.0MB
MD5

f578e571c629fd7780549091ab4658fd
SHA1

d8f442397889caffec5932f01fd2586df491c9f9
SHA256

2ff63e6c2d8b9221194d784a6493fc335498ee7ab70c85bf363d46f8f8b0ff66
SHA512

d445cb9784da54d412d207ec4b997bffd083684293298c86a75b06845935216bd85eadc403e889e6c70cbf6d64c203a906d254ffe01ca255a4a2d06aeed70710
SSDEEP

12288:UeULt/Z+lz3mCIV5upE5f+DJdqBgqCDPNeRGRF7nrowhav1oEmlS1a1t:UeULRoh+VgpEVBgnn

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://82.156.29.211:443/RxPC

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\444.exe
"C:\Users\Admin\AppData\Local\Temp\444.exe"
1⤵
PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/320-1-0x0000000002760000-0x0000000002B60000-memory.dmp

Filesize
4.0MB

Download
memory/320-2-0x0000000002760000-0x0000000002B60000-memory.dmp

Filesize
4.0MB

Download