cobaltstrike | 5360f5d3b3c1d88f96ea3abd65c840e932ab3905e1d69af9dfad15ba655cc2d8 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 10:30

Sharing

Report Analysis Logs

General

Target

d1b958de87834d0e55e29b5b8fba5ed9_JaffaCakes118.exe
Size

568KB
MD5

d1b958de87834d0e55e29b5b8fba5ed9
SHA1

2081b505c11b8a1dd30b5e2f93374df6130c7e32
SHA256

5360f5d3b3c1d88f96ea3abd65c840e932ab3905e1d69af9dfad15ba655cc2d8
SHA512

e008823f0482e89793d0f1de63327c1fe970ca4c6bf2d30ff185a356ecfcd519b4db4c24abd37de1e088f9e97723b7573249610a9a7b7960d6adbe809d2f2ac3
SSDEEP

12288:cbE33Nl1j1GZngaQ+gva8WeNYpiNoESk4uNV2EqyL:533nB74yahnE/L

Score

10^/10

cobaltstrike 0 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\d1b958de87834d0e55e29b5b8fba5ed9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1b958de87834d0e55e29b5b8fba5ed9_JaffaCakes118.exe"
1⤵
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-1-0x0000000002940000-0x00000000029C2000-memory.dmp

Filesize
520KB

Download
memory/1744-2-0x0000000000110000-0x000000000015C000-memory.dmp

Filesize
304KB

Download
memory/1744-3-0x0000000002940000-0x00000000029C2000-memory.dmp

Filesize
520KB

Download
memory/1744-4-0x0000000000110000-0x000000000015C000-memory.dmp

Filesize
304KB

Download