cobaltstrike | 70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/11/2024, 14:02

Sharing

Report Analysis Logs

General

Target

70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f.exe
Size

40KB
MD5

83b4a76392d375e8879f4b4de6991c82
SHA1

f3d7f281ae07d74111b7586382de948d86d6b3eb
SHA256

70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f
SHA512

7824aa26399b87b3ef38e4991d5ccd608fef728a0c3f726c15805c5f2247d47806aee802bcb5cd57bccea079e8ffc04845d663c5aa8636f7cd5db94e8b1d0540
SSDEEP

384:QvfxvntmHM5t44d/o8dLiwDH6yEIMwPhcqvFfBuD215Pfa:if5tlf44d/omVPEIFhVfBuDQfa

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.43.141:1111/HnRU

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f.exe
"C:\Users\Admin\AppData\Local\Temp\70a1e9d0cc1216350ce6ba96619dac2f672a1886fb69f51d41c5d6aef713f83f.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x0000000000D80000-0x0000000000DA0000-memory.dmp

Filesize
128KB

Download
memory/2264-1-0x0000000000D80000-0x0000000000DA0000-memory.dmp

Filesize
128KB

Download