cobaltstrike | 99dae8ec4ea0412987f7b96781f0339869a6b8c8794a43649d5a781de4ae4762 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/02/2025, 18:59

Sharing

Report Analysis Logs

General

Target

99dae8ec4ea0412987f7b96781f0339869a6b8c8794a43649d5a781de4ae4762.exe
Size

390KB
MD5

69027622c97349d59bf7408a879b84b7
SHA1

a5744a4796f43e1a11fae6d3bf0b4959607fc83d
SHA256

99dae8ec4ea0412987f7b96781f0339869a6b8c8794a43649d5a781de4ae4762
SHA512

d5d0a0678bd2971adec3522ea10318b7eb7f170fa67da86426ab84377e276214c7dd32526a3774379876244bbc3d9daca7450cf3092dacfd011d88e97c3c69e8
SSDEEP

6144:AyUdeqrKXc8f79tUyektmYghwk3Ta77HO60fWAUmBLvy1igKt5Vw:hwr4c8fAktrEwk3Ta77Hp0fWAUmB2CVw

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://192.168.206.141:8000/r8cP

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; MALCJS)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\99dae8ec4ea0412987f7b96781f0339869a6b8c8794a43649d5a781de4ae4762.exe
"C:\Users\Admin\AppData\Local\Temp\99dae8ec4ea0412987f7b96781f0339869a6b8c8794a43649d5a781de4ae4762.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x000000013F390000-0x000000013F3FD000-memory.dmp

Filesize
436KB

Download
memory/2388-2-0x000000013F390000-0x000000013F3FD000-memory.dmp

Filesize
436KB

Download