cobaltstrike | 525ae0739923dca53521ca8174b691ae59f32d4a57ee8f978ff3e9891c6401fc | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 04:05

Sharing

Report Analysis Logs

General

Target

525ae0739923dca53521ca8174b691ae59f32d4a57ee8f978ff3e9891c6401fc.exe
Size

2.3MB
MD5

37664778a8026af72b3d957419d182da
SHA1

e4e6ef9e527c2d4981a23d9b1de853380716161b
SHA256

525ae0739923dca53521ca8174b691ae59f32d4a57ee8f978ff3e9891c6401fc
SHA512

c2d657335665aedd5c6d53d7d80218782e8ba59c672b525fdb9ee0ac1ff9db7eee6ef55e19b64558ac82bab764a6bbe1e1a7affd92a51ab1b62754153a5940df
SSDEEP

24576:nTVGtcA1xyC4YvhamnCNVKeB1vc4ZcVsof9gcPPAPtEGH5AdoV6FaTv8:Tct4chafVKevv7m9gcPYPbH5oa78

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://h.com:8080/o2zB

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; LBBROWSER)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\525ae0739923dca53521ca8174b691ae59f32d4a57ee8f978ff3e9891c6401fc.exe
"C:\Users\Admin\AppData\Local\Temp\525ae0739923dca53521ca8174b691ae59f32d4a57ee8f978ff3e9891c6401fc.exe"
1⤵
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download