cobaltstrike | f9141cb660859120c823abac70f00249fd7a99a71662017ecd6175f87144d39c

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 10:32

Target

f9141cb660859120c823abac70f00249fd7a99a71662017ecd6175f87144d39c.exe
Size

19KB
MD5

3447066f2899e468ec3f3689105f1e5d
SHA1

7fcdc2e7e916f0098401327064baa1914bfecc10
SHA256

f9141cb660859120c823abac70f00249fd7a99a71662017ecd6175f87144d39c
SHA512

01ee32b4bac365982fae9a11d4307b7a8a5202d5c97d0bd10f822d966706e84144afe76026f832f9ca467c48ed4d5d717116c11a499fe8628d0465fad8ca3fbc
SSDEEP

192:vV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/26tblLah8HWF8qa1Dojjgi:pqaCF31cix+Dc4zjft1IFF46gi

Score

10^/10

Family

cobaltstrike

http://103.97.58.61:80/Ta9o

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; InfoPath.2)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\f9141cb660859120c823abac70f00249fd7a99a71662017ecd6175f87144d39c.exe
"C:\Users\Admin\AppData\Local\Temp\f9141cb660859120c823abac70f00249fd7a99a71662017ecd6175f87144d39c.exe"
1⤵
PID:2028

memory/2028-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x0000000004470000-0x0000000004870000-memory.dmp

Filesize
4.0MB

Download
memory/2028-2-0x0000000000510000-0x0000000000566000-memory.dmp

Filesize
344KB

Download
memory/2028-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2028-5-0x0000000000510000-0x0000000000566000-memory.dmp

Filesize
344KB

Download