cobaltstrike | be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 10:31

Target

be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1.exe
Size

19KB
MD5

866ba379b549c8a3b62ca1872477377d
SHA1

bf0822b9af2346c814d4fd7782da18d31b6e0411
SHA256

be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1
SHA512

af49022bc1bc94fcef826d3d4334f45d8f9613c8c1c94023f958b0f62bb448d2b4936469feddbac91df2eae113a218d0b686e4609bf0eb75e01e2ecdf45df6e5
SSDEEP

192:kV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2mbauu/7TWF8qa1Dojjgi:WqaCF31cix+Dc4zjja7+FF46gi

Score

10^/10

Family

cobaltstrike

http://156.251.172.80:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.vip8806.mom Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1.exe
"C:\Users\Admin\AppData\Local\Temp\be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1.exe"
1⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\Cab195C.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
memory/1924-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1924-17-0x00000000047E0000-0x0000000004C52000-memory.dmp

Filesize
4.4MB

Download
memory/1924-18-0x00000000043E0000-0x00000000047E0000-memory.dmp

Filesize
4.0MB

Download
memory/1924-19-0x00000000023A0000-0x00000000023A2000-memory.dmp

Filesize
8KB

Download
memory/1924-20-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1924-22-0x00000000043E0000-0x00000000047E0000-memory.dmp

Filesize
4.0MB

Download