cobaltstrike | ff62a4c67fac4e7a5b6009b724d682c25699f1b9be6deaed723ea5d883f2fc9b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 10:18

Target

ff62a4c67fac4e7a5b6009b724d682c25699f1b9be6deaed723ea5d883f2fc9b.exe
Size

19KB
MD5

bf7377591f41478bab11da363dd771a0
SHA1

4758b0538326491ff7e5f6045ff7d0d88e1ec6ca
SHA256

ff62a4c67fac4e7a5b6009b724d682c25699f1b9be6deaed723ea5d883f2fc9b
SHA512

48247dcb709da88f4bd6bb145910d806f645fbfab624bbd6c15ab75cc08473fe1f6d0e20d055124a345796923c3f658a0536d8b28c1a7b8aba1a81097c450668
SSDEEP

192:vV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2ZEmh+WF8qa1Dojjgi:pqaCF31cix+Dc4zjRm1FF46gi

Score

10^/10

Family

cobaltstrike

http://192.168.34.32:80/Cz1o

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENXA)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\ff62a4c67fac4e7a5b6009b724d682c25699f1b9be6deaed723ea5d883f2fc9b.exe
"C:\Users\Admin\AppData\Local\Temp\ff62a4c67fac4e7a5b6009b724d682c25699f1b9be6deaed723ea5d883f2fc9b.exe"
1⤵
PID:1668

memory/1668-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1668-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download