cobaltstrike | fe14779dc9281fadf03d286003c46c1e2b98e5cdeb79f4ad38f0e74f31f9f0c2 | Triage

Analysis

max time kernel
132s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 08:42

Sharing

Report Analysis Logs

General

Target

fe14779dc9281fadf03d286003c46c1e2b98e5cdeb79f4ad38f0e74f31f9f0c2.exe
Size

108KB
MD5

9f3ed9525df8efdcb81f5c89bcc753b1
SHA1

b3604e26e00fe072b44ad66baff36eb1c5d2bdcb
SHA256

fe14779dc9281fadf03d286003c46c1e2b98e5cdeb79f4ad38f0e74f31f9f0c2
SHA512

4a71965648708642afdc0dc8f8e66e3b5bd4bea9b5c862e7206e34bdccde4d2761e069ac22f6846f60d97e23e4839c9ecafc0255b356814072ad42dfff40ebb9
SSDEEP

1536:+8BuezwI3vEyKs6vb+clSzkv0kWqZZrqDxcK8sWwd49dlCp2+h0:PB/c3b+CKkv0pqZZrAx7boYp2+h0

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://10.0.1.4:8090/UQvA

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\fe14779dc9281fadf03d286003c46c1e2b98e5cdeb79f4ad38f0e74f31f9f0c2.exe
"C:\Users\Admin\AppData\Local\Temp\fe14779dc9281fadf03d286003c46c1e2b98e5cdeb79f4ad38f0e74f31f9f0c2.exe"
1⤵
PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download