Overview

overview

10

Static

static

10

d1b7c8adda...ea.exe

windows7-x64

10

d1b7c8adda...ea.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-03-2024 15:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe

  • Size

    423KB

  • MD5

    0cbe5e9eb925650ae2637fc171770689

  • SHA1

    a46309d54abddefc3e96ab8316c0dd3f853fa7a0

  • SHA256

    d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea

  • SHA512

    82f8b082842e0ac0e80ede8eec9eb76fbf865c33cfb4cd36ec26b4431835df5ac87378dba8192163a19a0844d9eb2f0341b56c573035ce97e7867ded168d6d19

  • SSDEEP

    3072:146YJeQJxhAgvDtXlW6CoU7on12W4WQmg32hE0nuKo0Lrgu6cO4MQq3jq4FCgDjP:14HoWJDBlSCmj3jqUtbUilcAOPFs

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://����/uGHX:808333358I��Ey�KI�纆M��

Attributes
  • user_agent

    I��Ey�KI�纆M��

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe
    "C:\Users\Admin\AppData\Local\Temp\d1b7c8adda65d9f2d3c8e1b1085458c20ffbec0a14c7b9bc571026fe00b56cea.exe"
    1⤵
      PID:2824
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3724

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2824-0-0x00007FF790F20000-0x00007FF790F83000-memory.dmp
        Filesize

        396KB

        Download