cobaltstrike | fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba

Analysis

max time kernel
147s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:31

Target

fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba.exe
Size

4.1MB
MD5

a822ad57e960e2dffdc8c9fdddc2ecf4
SHA1

8aab7a4a40e949ad49040b6b141fcb81cb2479bd
SHA256

fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba
SHA512

f860dc91811408168d594be2de5d98df762138fb4376b1bc022ef1af5ae527cc617cff1ddf9b428e6bddecabc59a0a02a8202d610c5976f0d6af3621b24838aa
SSDEEP

98304:HljI1SmddLRrsR/Y92q5HNFLOAkGkzdnEVomFHKnPP:HJAd0Ysq5HNFLOyomFHKnPP

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba.exe

pid	process
4612	fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba.exe
4612	fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba.exe

C:\Users\Admin\AppData\Local\Temp\fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba.exe
"C:\Users\Admin\AppData\Local\Temp\fd7ddb3105b4acc3193b42a2475c39921656f70af0a390439bcfb7d3ecd1bcba.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4612

memory/4612-0-0x00007FFE835D0000-0x00007FFE837C5000-memory.dmp

Filesize
2.0MB

Download
memory/4612-1-0x000001993F310000-0x000001993F351000-memory.dmp

Filesize
260KB

Download