cobaltstrike | e903253b73d3e43e98088dce800bd5fb75c9b2786153c6d0150080c1d002bbb3 | Triage

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 11:13

Sharing

Report Analysis Logs

General

Target

temp/1.exe
Size

19KB
MD5

5cebc6552eb1d0665391ddbe8a25bfff
SHA1

5790e528e7a31624698be513cfde41434c00fa08
SHA256

2d4791c66db346075cc3811dedc19b66cdda13d8deb7ef3c5aa44843e8e61597
SHA512

6fca698ba55bff41b4b72510d0038a7bbcb73a6e7e4033090ddb2f578b370e330b492bd2c7ee1169ed03b87caff593c23c967994e54f70eed88e337da1649c92
SSDEEP

192:wV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2bG2IZB0EaFWF8qa1Dojjgi:SqaCF31cix+Dc4zjsq9aoFF46gi

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://124.222.72.51:4433/TY7y

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\temp\1.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1488-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download