cobaltstrike | 6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 00:29

Target

6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f.exe
Size

5KB
MD5

34b0e24bc18ed17d512a092c28c64407
SHA1

0fead8a34d86ed0cdc546b5fddea4e66a50434c6
SHA256

6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f
SHA512

b76dfe35b68efa45091f9ed81791186490a7b94380fafc15c9c3097cf47b7c646ebc58da04d7ac842189e8ddbcd6b9b92c2463eb3e256c614d5de4773c4d0b62
SSDEEP

96:azMFIRTlIk3ZiDtk/7HuNxbC9mJRawgbpzNt:/IRV3Z36NE9HL

Score

10^/10

Family

cobaltstrike

http://192.168.1.66:443/o7bU

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f.exe
"C:\Users\Admin\AppData\Local\Temp\6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f.exe"
1⤵
PID:3012

memory/3012-0-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x000000013F9F0000-0x000000013F9F6000-memory.dmp

Filesize
24KB

Download
memory/3012-2-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

Filesize
4KB

Download
memory/3012-3-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/3012-4-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download