cobaltstrike | cedc6f982c1474a571ea4416d7fb5897b76e994800e52aceb04d52a77d9a380f

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
06-12-2023 03:26

Target

cedc6f982c1474a571ea4416d7fb5897b76e994800e52aceb04d52a77d9a380f.exe
Size

245KB
MD5

b34570e1966652e0ad872a69e96ec118
SHA1

d7a32d851b54207df1a508f32f6e5092138659d7
SHA256

cedc6f982c1474a571ea4416d7fb5897b76e994800e52aceb04d52a77d9a380f
SHA512

28742ee2063a20b999f82aa900d751572388a5d9d18f65d7e77fedcce43da46802bc941b8fb5e75d86f21325bbf7bf95a68e2cc646570f0cf7c47d895023eeef
SSDEEP

3072:llXZp+gGQy/I6LPTFNIPudOYx0ncvMZdcYA7m1sgIkDHQtof1Cz1ZEhuHXuz3TnB:llndJyqO86ixESti1C3Tn6crItBdA

Score

10^/10

Family

cobaltstrike

http://172.245.112.78:9987/DUUo

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\cedc6f982c1474a571ea4416d7fb5897b76e994800e52aceb04d52a77d9a380f.exe
"C:\Users\Admin\AppData\Local\Temp\cedc6f982c1474a571ea4416d7fb5897b76e994800e52aceb04d52a77d9a380f.exe"
1⤵
PID:2548

memory/2548-0-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2548-2-0x000000013F2B0000-0x000000013F2F0000-memory.dmp

Filesize
256KB

Download