Overview

overview

10

Static

static

3

Session.exe

windows7-x64

10

Session.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Session.exe

  • Size

    19KB

  • MD5

    cb67537ad9beafe9cac0b24ee41f4470

  • SHA1

    dbbd990870c911545697c2389eaa2c11d3ab286e

  • SHA256

    1a84fcbdb477c07883edf49d32754c173df5f451bc22af113cb241987af96ace

  • SHA512

    0fcc75d2026d371d83dc12f1673323594d29338bb711a048a41a887e88d8ab6e869fd6daa4f35d685b03e592546106cee0eb702c11012b4a908bc9475e03b766

  • SSDEEP

    192:NeV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2gaWF8qa1Dojjgi:NoqaCF31cix+Dc4zjdFF46gi

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://193.117.208.148:7800/zQLF

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;SVSE)

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Session.exe
    "C:\Users\Admin\AppData\Local\Temp\Session.exe"
    1⤵
      PID:1988

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1988-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1988-1-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

      Download