cobaltstrike | 0c4063a018be09175967a43b7b749dbf77e72662b5001d0115a3bd4db53b8376 | Triage

Analysis

max time kernel
90s
max time network
26s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 04:02

Sharing

Report Analysis Logs

General

Target

0c4063a018be09175967a43b7b749dbf77e72662b5001d0115a3bd4db53b8376.exe
Size

2.3MB
MD5

15bf5bcc906086581fd11c5194f57b57
SHA1

79f41225ae8bc1834af28c097724d0cad6f19b4e
SHA256

0c4063a018be09175967a43b7b749dbf77e72662b5001d0115a3bd4db53b8376
SHA512

beab5330db549c984086f8626058be00fad02191e83903b1ac1ecfe541610e61af0b1f16f0ea7d788d785ded75b4742ce1d248256f6c22a8fc0b51f645b1776a
SSDEEP

24576:nTVGtcA1xyC4YPhAmnCNVKeB1vc4ZcVsof9gcbPAPtEGH5AnoV6FaTv8:Tct4ghAfVKevv7m9gcbYPbH5Ga78

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://h.com:8080/o2zB

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; LBBROWSER)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\0c4063a018be09175967a43b7b749dbf77e72662b5001d0115a3bd4db53b8376.exe
"C:\Users\Admin\AppData\Local\Temp\0c4063a018be09175967a43b7b749dbf77e72662b5001d0115a3bd4db53b8376.exe"
1⤵
PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download