cobaltstrike | 22e532af4af7b02ec053b877ba2495e090c1b5c89c36a3877fbf11081fdb17a2 | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:16

Sharing

Report Analysis Logs

General

Target

22e532af4af7b02ec053b877ba2495e090c1b5c89c36a3877fbf11081fdb17a2.exe
Size

19KB
MD5

7c6690e82c4b454cb35000058c493bce
SHA1

f486131ef2ccab2ae1c88fc43806617ecef55af9
SHA256

22e532af4af7b02ec053b877ba2495e090c1b5c89c36a3877fbf11081fdb17a2
SHA512

b6267804f610fe7ad6fec6a421fca2f6f09028096c6cb0adf5c40539ac602486c17f02e750f60dd312bce15483c536fdd0a7ada07328fda51b032e22196c1d31
SSDEEP

192:VV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/25JMWF8qa1Dojjgi:3qaCF31cix+Dc4zjAfFF46gi

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://54.39.19.94:19980/3Kpo

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 like Gecko

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\22e532af4af7b02ec053b877ba2495e090c1b5c89c36a3877fbf11081fdb17a2.exe
"C:\Users\Admin\AppData\Local\Temp\22e532af4af7b02ec053b877ba2495e090c1b5c89c36a3877fbf11081fdb17a2.exe"
1⤵
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x00000000007D0000-0x0000000000828000-memory.dmp

Filesize
352KB

Download
memory/2156-2-0x0000000003CC0000-0x00000000040C0000-memory.dmp

Filesize
4.0MB

Download
memory/2156-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2156-4-0x0000000003CC0000-0x00000000040C0000-memory.dmp

Filesize
4.0MB

Download