cobaltstrike | 45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 05:18

Target

45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d.exe
Size

499KB
MD5

f741b1824d3fed14b7d629075f68d433
SHA1

4e52420a731952085cbf8f334891701da9dbfea3
SHA256

45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d
SHA512

de057a8f5b3a9782f805f098c1226674dd1ca8d38ea2fd2710bf085de4da33b3851ef572f2408f85f209b72959917321b45bd529a5b39630747bf14f59bb36fe
SSDEEP

12288:AzZy+ToGFKWekWT5jvJKw0wnPDOrzEcl:A1LiWekWT5jvJKw0wnbOH

Score

10^/10

Family

cobaltstrike

http://storage.termservhub.com:443/embedded/singlePageReactModel.png

Attributes

user_agent
Host: storage.termservhub.com Connection: close Accept-Encoding: br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d.exe

pid process

3020 45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d.exe

pid	process
3020	45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d.exe

C:\Users\Admin\AppData\Local\Temp\45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d.exe
"C:\Users\Admin\AppData\Local\Temp\45fddadaa43511409a1efc4d181439cf5d056391d4f62d91450ba661e74a4d7d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3020

memory/3020-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download