cobaltstrike | e062f6ae9f075fcbcf110849533d254e04096d1b5cd856c5238fbae7bbc700e3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 14:58

Target

e062f6ae9f075fcbcf110849533d254e04096d1b5cd856c5238fbae7bbc700e3.exe
Size

1.0MB
MD5

d1f42834531fdbec1326f9fda4743f79
SHA1

368b87c9e4298217024ffc23a05c21e77484d1ce
SHA256

e062f6ae9f075fcbcf110849533d254e04096d1b5cd856c5238fbae7bbc700e3
SHA512

49fe3249829c8be327ba4aedbfb9c9a526f90e2c1e7048cf27dc3423cc4e3e6c78b05902395480c7d814494292a92ccaf2c734acab69181fb71a48eaab0f350f
SSDEEP

24576:qxjwhd9rijrNCLtaSb89qYl9F8zeG/1SrgFDyvbM753e4mJLVE51f:qx4GZCLtaSI4eAbNS+yvba53tOLVcN

Score

10^/10

Family

cobaltstrike

http://192.168.137.130:8888/v95y

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MAARJS)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

C:\Users\Admin\AppData\Local\Temp\e062f6ae9f075fcbcf110849533d254e04096d1b5cd856c5238fbae7bbc700e3.exe
"C:\Users\Admin\AppData\Local\Temp\e062f6ae9f075fcbcf110849533d254e04096d1b5cd856c5238fbae7bbc700e3.exe"
1⤵
PID:4208

memory/4208-0-0x0000000000980000-0x0000000000B85000-memory.dmp

Filesize
2.0MB

Download
memory/4208-1-0x000002DC6A8B0000-0x000002DC6A8B1000-memory.dmp

Filesize
4KB

Download
memory/4208-2-0x0000000000980000-0x0000000000B85000-memory.dmp

Filesize
2.0MB

Download
memory/4208-8-0x0000000000980000-0x0000000000B85000-memory.dmp

Filesize
2.0MB

Download
memory/4208-14-0x0000000000980000-0x0000000000B85000-memory.dmp

Filesize
2.0MB

Download