cobaltstrike | d1e781d8f4482bd09ab1c8ee54f360d82d7ca3bc69a1f17943e1b517a9c060af | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1111.exe
Size

17KB
MD5

49a0821c6989b44a7966adf3442b31a7
SHA1

a086d32bb6f73d893166a76a6b8b76b15d225e46
SHA256

d1e781d8f4482bd09ab1c8ee54f360d82d7ca3bc69a1f17943e1b517a9c060af
SHA512

b7fa9b540745c0ccae520e426a6f3ec254334173f50fe4c898cc69da3540d64b2dc39547efcb9c1792df6ddc88c9bbdf780fee2fd06f009b3c714aba9fb45e20
SSDEEP

192:oDMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4WlcvjBCiBUbOj6kxiY:oDMAoKz6WtKEj7aBDiLlcFCibAY

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://123.60.128.4:159/FUQq

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\1111.exe
"C:\Users\Admin\AppData\Local\Temp\1111.exe"
1⤵
PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1948-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download