cobaltstrike | d705104d68ca0dc480b7f49e1dd079cd95ef64f21f7a45a9b5b367462f8ab6f9

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 21:57

Target
d705104d68ca0dc480b7f49e1dd079cd95ef64f21f7a45a9b5b367462f8ab6f9.exe
Size 361KB
Sample240724-1txg2azank
SHA256 d705104d68ca0dc480b7f49e1dd079cd95ef64f21f7a45a9b5b367462f8ab6f9
MD5 d1e9e70ecbf4c41cd6c4dc54680e2218
SHA1 377bec32993d7782bfa5de786aef1b406b9ef357
SHA512 8de97e6822d933775af51b250f893348315024e4062ccdfe601fb96c99f7c0610d4c63b5d559f00df801af1ee36bfd1dd3771cdc1f091762e21cf948120e4734
SSDEEP 6144:3NpRP5j0n5TsRdGUZD3Q5UPl3iUcJJJ655ZZoMb8rdvL4s68dTlcEo6IpiWe97TX:3NpRP5jQCRdrD39BcEPxROZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

http://36.138.209.232:60443/api-gateway/jpaas-jis-coruser-server/front/coruserlogin/usernamepwd-login.jspx

Attributes

user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: https://zwdtuser.sh.gov.cn/uc/naturalUser/loginNew.do Accept-Encoding-V2: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\d705104d68ca0dc480b7f49e1dd079cd95ef64f21f7a45a9b5b367462f8ab6f9.exe
"C:\Users\Admin\AppData\Local\Temp\d705104d68ca0dc480b7f49e1dd079cd95ef64f21f7a45a9b5b367462f8ab6f9.exe"
1⤵
PID:3004

memory/3004-0-0x000001B009030000-0x000001B009031000-memory.dmp

Download

memory/3004-1-0x00007FF762600000-0x00007FF762657000-memory.dmp

Download