cobaltstrike | 1600-69-0x000007FEF6460000-0x000007FEF650C000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1600-69-0x000007FEF6460000-0x000007FEF650C000-memory.dmp
Size

688KB
MD5

887df09c1ed33dce2744210a64dab8c6
SHA1

ee5e004790a23a9d2d4f265c2908a862c4138fbb
SHA256

3c3b835910fb2b34f6f4c019958e821c44b452fd3ea25185441303639389c750
SHA512

98c7a7a82109e0b7db025242afdaa3d8224d90d1cf954906813614c88de1fb3b1fbb07ce39b1675e61c0a3689481012b9999bb0c3c26e647555fb60164d99fec
SSDEEP

12288:GEfOMJ8dRUjQExAjbIS0wSJSkORCXdpVo2GN:PfO3MM0AjbIpwSTOWfVPy

Score

10^/10

0 cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike family
cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1600-69-0x000007FEF6460000-0x000007FEF650C000-memory.dmp

Files

1600-69-0x000007FEF6460000-0x000007FEF650C000-memory.dmp
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 584KB - Virtual size: 583KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ