cobaltstrike | 88cfede42188d89c02902431f688fd90b5947eb2155f6b40a1f75f3cfc010e2b | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 02:05

Sharing

Report Analysis Logs

General

Target

coba164s.exe
Size

318KB
MD5

1715d2b27d963988cac67a955812e4d0
SHA1

8831d9c375b0f3df5e40731d091d468d5764dad2
SHA256

d61f250ce0bc5dd194878de7495bf657bf9749ead64130935c24b7b12978e683
SHA512

ea5a9a8266cba81ec3232c1ae41897f8ef6972851c15cb51fd364ee895f4edcff2e62babef8a278560e17b33e639ab1b0024c1de7024d4d0b3180f60adb1acc0
SSDEEP

6144:4FKitXrJ6qUIbupzBTk1TRnK+kuuEci72o0i/p1IEh:OstIeBTcK+kuuFFo0l

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://1nevadasports.com:443/erDB

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\coba164s.exe
"C:\Users\Admin\AppData\Local\Temp\coba164s.exe"
1⤵
PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download