cobaltstrike | 6cf07e25cd9a64092833efff3aa2706a10566a8281adb9324485aa79ca1644df

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:49

Target
dfa33b2369f141c4118a21c79fa70b6b.exe
Size 9KB
Sample240326-vbpftahf71
SHA256 6cf07e25cd9a64092833efff3aa2706a10566a8281adb9324485aa79ca1644df
MD5 dfa33b2369f141c4118a21c79fa70b6b
SHA1 aaabde1b3f23f4331e07de6f469db6aeca5901af
SHA512 f70c0424e3cd1f05d29b28ec4af48974ba1c2ba6f0825b2bfdf6867cfa1bb509e3f85219dc0af831228cba82e9292a5bd6d78c6ea281e6f6d67640453d79534f
SSDEEP 192:reTG9Y8DtPMo9Qc+NUejoyGY6birXcyOwdWWS+:889RujoO6biTjt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\dfa33b2369f141c4118a21c79fa70b6b.exe
"C:\Users\Admin\AppData\Local\Temp\dfa33b2369f141c4118a21c79fa70b6b.exe"
1⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3652

memory/684-0-0x00007FF984200000-0x00007FF984BA1000-memory.dmp

Download

memory/684-1-0x00007FF984200000-0x00007FF984BA1000-memory.dmp

Download

memory/684-2-0x0000000001330000-0x0000000001340000-memory.dmp

Download

memory/684-7-0x000000001BC00000-0x000000001BC01000-memory.dmp

Download

memory/684-8-0x00007FF984200000-0x00007FF984BA1000-memory.dmp

Download