cobaltstrike | 15ef590344ab16262050681b1522a6a42f1ba0ae15d9b0a24d04cf385bc4e9fa | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 17:38

Sharing

Report Analysis Logs

General

Target

15ef590344ab16262050681b1522a6a42f1ba0ae15d9b0a24d04cf385bc4e9fa.exe
Size

91KB
MD5

3bcbe3a061ab94b8d70a56abb8b7f665
SHA1

a256b6fbd7e3827a581f3fc341604dcb9ea985fd
SHA256

15ef590344ab16262050681b1522a6a42f1ba0ae15d9b0a24d04cf385bc4e9fa
SHA512

c863d83d42fae317233efccc95ac571e3ed35225d52f2fb5f118389062dda8ee7159f6284688816a20238f0ce4b80dc12f5a53493711f730e5c46e4c045ce0bf
SSDEEP

1536:J3RX/eyOeQ9weNwcpxhqSC6NGuggQ+k5M5GsWFdZ9dlFdvgQEnl:J3RX/eyM9wiJxhq/kGuggQ+8MSRHdvgD

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://gavbonoer.com:80/yUAN

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3818.0 Safari/537.36 Edg/77.0.188.0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\15ef590344ab16262050681b1522a6a42f1ba0ae15d9b0a24d04cf385bc4e9fa.exe
"C:\Users\Admin\AppData\Local\Temp\15ef590344ab16262050681b1522a6a42f1ba0ae15d9b0a24d04cf385bc4e9fa.exe"
1⤵
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download