cobaltstrike | be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 10:31

Target

be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1.exe
Size

19KB
MD5

866ba379b549c8a3b62ca1872477377d
SHA1

bf0822b9af2346c814d4fd7782da18d31b6e0411
SHA256

be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1
SHA512

af49022bc1bc94fcef826d3d4334f45d8f9613c8c1c94023f958b0f62bb448d2b4936469feddbac91df2eae113a218d0b686e4609bf0eb75e01e2ecdf45df6e5
SSDEEP

192:kV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2mbauu/7TWF8qa1Dojjgi:WqaCF31cix+Dc4zjja7+FF46gi

Score

10^/10

Family

cobaltstrike

http://156.251.172.80:443/jquery-3.3.2.slim.min.js

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.vip8806.mom Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1.exe
"C:\Users\Admin\AppData\Local\Temp\be5bc7daa02ca6b04650aa6309a556d3fc1be41eac71ee0498873ffc793a68f1.exe"
1⤵
PID:4604

memory/4604-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/4604-4-0x0000000003BE0000-0x0000000003E9D000-memory.dmp

Filesize
2.7MB

Download
memory/4604-3-0x0000000003FE0000-0x0000000004452000-memory.dmp

Filesize
4.4MB

Download
memory/4604-5-0x0000000003EA0000-0x0000000003EA2000-memory.dmp

Filesize
8KB

Download
memory/4604-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4604-8-0x0000000003BE0000-0x0000000003E9D000-memory.dmp

Filesize
2.7MB

Download