cobaltstrike | 7b011639d5b961722e147a39076014566b9578b44fdbd9c7d74274e4b29941a6 | Triage

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
18/11/2024, 06:05

Sharing

Report Analysis Logs

General

Target

7b011639d5b961722e147a39076014566b9578b44fdbd9c7d74274e4b29941a6.exe
Size

19KB
MD5

8f2fe410614b408ef6eb2f5cbafd6d32
SHA1

286b9fcda44141f77902cf0567cd645f47e2d6da
SHA256

7b011639d5b961722e147a39076014566b9578b44fdbd9c7d74274e4b29941a6
SHA512

ce624d22eb1e484c07aefec9b8796703c995ca1755367c8bca08c9997c7b478fc2afeb8c738a2b176aa475b95fed7893fb0d817d55f40a16cc993fedeccf24dc
SSDEEP

192:oV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/243Kk4rRaWF8qa1Dojjgi:aqaCF31cix+Dc4zjDQrRDFF46gi

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://8.137.70.196:5555/nWSE

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\7b011639d5b961722e147a39076014566b9578b44fdbd9c7d74274e4b29941a6.exe
"C:\Users\Admin\AppData\Local\Temp\7b011639d5b961722e147a39076014566b9578b44fdbd9c7d74274e4b29941a6.exe"
1⤵
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1644-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download