cobaltstrike | 24aa4a38544814f3c33269086e8f7b3ee1960413be3d6dae5cd041a7384c29d3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 13:07

Target

24aa4a38544814f3c33269086e8f7b3ee1960413be3d6dae5cd041a7384c29d3.exe
Size

19KB
MD5

6d1d5432d85588dae4a54b1bd983cc37
SHA1

b640675328b570b122c72c4bba9f740d13dbb62f
SHA256

24aa4a38544814f3c33269086e8f7b3ee1960413be3d6dae5cd041a7384c29d3
SHA512

413aa7d9b4b5e06841daaf4ab03ff9aa2eaa1a40a7a99d4d8e8c6f78c09683d1ab9b33284e73514e5ad60e7c8a9b084dceb8353fab4555761a548a31e1aced16
SSDEEP

192:vV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2bEdwWF8qa1Dojjgi:pqaCF31cix+Dc4zjdFF46gi

Score

10^/10

Family

cobaltstrike

http://192.168.51.158:80/QNKs

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\24aa4a38544814f3c33269086e8f7b3ee1960413be3d6dae5cd041a7384c29d3.exe
"C:\Users\Admin\AppData\Local\Temp\24aa4a38544814f3c33269086e8f7b3ee1960413be3d6dae5cd041a7384c29d3.exe"
1⤵
PID:2596

memory/2596-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2596-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download