cobaltstrike | fcfb58a946ac439b29790d21b7d91bcfea1f712c6c59d2615c8e4488bcf7f3e9

Analysis

max time kernel
149s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 11:42

Target

abcda32e5175106e924c6c54aa9d668c.exe
Size

5.6MB
MD5

abcda32e5175106e924c6c54aa9d668c
SHA1

afda1a8b53b8762400747a1c29daa14987eeb0d8
SHA256

fcfb58a946ac439b29790d21b7d91bcfea1f712c6c59d2615c8e4488bcf7f3e9
SHA512

dd01885d063630e359f52b8a2c4b70879fe27d00e1208121c535bbb7db3e939059a86d33cbb431084d689b727ebb80053853ed05b3f7d51d883734964e4b1476
SSDEEP

49152:0WpYpBG9KjO+oZcsbej9U1pCOx7NE4WpYpBG9KjO+oZcsbej9U1pCOx7NE:r6BjcZcj6Mf6BjcZcj6M

Score

10^/10

Family

cobaltstrike

http://101.200.61.207:65501/KZEs

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\abcda32e5175106e924c6c54aa9d668c.exe
"C:\Users\Admin\AppData\Local\Temp\abcda32e5175106e924c6c54aa9d668c.exe"
1⤵
PID:2508

memory/2508-0-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x0000000001300000-0x0000000002056000-memory.dmp

Filesize
13.3MB

Download
memory/2508-7-0x0000000001300000-0x0000000002056000-memory.dmp

Filesize
13.3MB

Download
memory/2508-13-0x0000000001300000-0x0000000002056000-memory.dmp

Filesize
13.3MB

Download