cobaltstrike | 5140669d5ce0a812ace54e5896b723eb764de7d56ae5a48ca7896abb4a9d92f4

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 17:16

Target

5140669d5ce0a812ace54e5896b723eb764de7d56ae5a48ca7896abb4a9d92f4.exe
Size

19KB
MD5

ac4b7dcaff4069283f91287d73e03151
SHA1

61c8b4c715d9c6ee7dfd4af2bd935004e636da19
SHA256

5140669d5ce0a812ace54e5896b723eb764de7d56ae5a48ca7896abb4a9d92f4
SHA512

6d3a0c2f2de6ebf61699797e7d2642fac96e730de933c83e4912e61e74071c545624bd22f175e4a09d5933d0375d04e5f139dca8d9d2877d9dec550c8f408b5a
SSDEEP

192:BV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2s4AhYWF8qa1Dojjgi:TqaCF31cix+Dc4zjuAhtFF46gi

Score

10^/10

Family

cobaltstrike

http://192.168.188.139:80/iMRU

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP02)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\5140669d5ce0a812ace54e5896b723eb764de7d56ae5a48ca7896abb4a9d92f4.exe
"C:\Users\Admin\AppData\Local\Temp\5140669d5ce0a812ace54e5896b723eb764de7d56ae5a48ca7896abb4a9d92f4.exe"
1⤵
PID:1700

memory/1700-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download