cobaltstrike | 9d5d1b2c713498f00c4768046a7c42dce42713ee7d8eb5c2145dcd178d348edc | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 08:40

Sharing

Report Analysis Logs

General

Target

RCSInstall.exe
Size

1.2MB
MD5

b9f122088ef2a9781beb4f8258685086
SHA1

6291ad582a9c917a6064a7aa5f7d62da2bb5ee4c
SHA256

9d5d1b2c713498f00c4768046a7c42dce42713ee7d8eb5c2145dcd178d348edc
SHA512

eeb23ca6d45e99bc6fcfae71bd82af0aeb56825e3dee243ce6c2fbd1601b156f1b1d4f537466acb9d1e614a898541729bbcb47198db0a93adb7e73dbe39db6b6
SSDEEP

12288:K/p9Rjmu9Rdix/3qngsgR8mGNoZDxIogIKQiBKF0tYtQadWM:KllRdix/eOGiDTGvgmqndWM

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://101.35.246.111:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\RCSInstall.exe
"C:\Users\Admin\AppData\Local\Temp\RCSInstall.exe"
1⤵
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download