cobaltstrike | 6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f

Analysis

max time kernel
130s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 00:29

Target

6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f.exe
Size

5KB
MD5

34b0e24bc18ed17d512a092c28c64407
SHA1

0fead8a34d86ed0cdc546b5fddea4e66a50434c6
SHA256

6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f
SHA512

b76dfe35b68efa45091f9ed81791186490a7b94380fafc15c9c3097cf47b7c646ebc58da04d7ac842189e8ddbcd6b9b92c2463eb3e256c614d5de4773c4d0b62
SSDEEP

96:azMFIRTlIk3ZiDtk/7HuNxbC9mJRawgbpzNt:/IRV3Z36NE9HL

Score

10^/10

Family

cobaltstrike

http://192.168.1.66:443/o7bU

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f.exe
"C:\Users\Admin\AppData\Local\Temp\6b1d6e1fa0087fbbbfb33e85a561b14c654923515be8f078a9bd2af08773053f.exe"
1⤵
PID:3108

memory/3108-0-0x00007FF810C13000-0x00007FF810C15000-memory.dmp

Filesize
8KB

Download
memory/3108-1-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/3108-2-0x00007FF810C13000-0x00007FF810C15000-memory.dmp

Filesize
8KB

Download
memory/3108-3-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/3108-4-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download