cobaltstrike | 53ce8405f73176baefb696c0674e7c40a1ae995c53e38e21e84844413f419a17

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 01:01

Target
xor.exe
Size 2.1MB
Sample240518-bc8rascc96
SHA256 53ce8405f73176baefb696c0674e7c40a1ae995c53e38e21e84844413f419a17
MD5 77a9d5b4135a0f4f03659c4b65985308
SHA1 5a78aae4de7f958b17afb78687bdfc5aabd95253
SHA512 2cf11f5995a549fd2e55b54fb210758c1155e39d93922cd1456ff0278868ebe8ace12e2f10ddb680f2b9377a1781058c557820cfc758ecbf23f9a1577da2120b
SSDEEP 24576:yuDCEcSRZqqJFL9njBIhVJwlzzRfNikVIsz+hx2VIdJGUgDFzvIabIFubZTzukbi:fPcSR9JjjySI0+TdtKGubZ+Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\xor.exe
"C:\Users\Admin\AppData\Local\Temp\xor.exe"
1⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:1628