cobaltstrike | 5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/03/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d.exe
Size 291KB
Sample260320-mxkqradv91
SHA256 5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d
MD5 53a9d6356068db3836ae9518605a01ab
SHA1 61268180475c343660e2760bdea80048a55700a2
SHA512 54a89ce64173d03b4e8c5d03eb4ac1a1127cd18c1d9aeb584e1f771923916b189c3f662d1a882fef14bff1d389411c4c8ee7c9e331380adba6ff4229a2c26435
SSDEEP 6144:OYaj79R5YOP35zaCGqwruLE8JIPDlIrNG2MwygFUuxpDD+TXxMN:faRY63Ls+NaPD+G+UuxYTB
TLSH
T16C54AECBABFE187CF72953FD886A9B3FB8CA215C804DAAD1D493D9211D01C56341D636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 391144938 cobaltstrike trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

http://8293qv17gx64.vicp.fun:46968/pixel

Attributes

access_type
512
beacon_type
2048
host
8293qv17gx64.vicp.fun,/pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
46968
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9aTwoVUohtdljeFb9juyDC4Wo44leNzO+gbxmkQTvlXL0zVUiEEMn3BbaFCGGb1SOYg8UWRgXNCrOWvCmL4QTxZ0VX+sfxnAIg+QDxcHltsNir12GWUm4qC3f9x/5JbLCdnRvemRFChOi3HRb5RgnzekXvN8kUU5zBP/FDGzZ7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1)
watermark
391144938

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d.exe
1076	5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3152	1076	5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3152
- C:\Users\Admin\AppData\Local\Temp\5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d.exe
  "C:\Users\Admin\AppData\Local\Temp\5b39fd9f10f8506f824df38339ce8644c684232cba2b4481e6a0fdfae906fe8d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-3-0x00007FF7EE220000-0x00007FF7EE270000-memory.dmp

Download

memory/3152-0-0x0000000003AB0000-0x0000000003AF4000-memory.dmp

Download

memory/3152-1-0x0000000003BC0000-0x0000000003C12000-memory.dmp

Download

memory/3152-2-0x0000000002270000-0x0000000002272000-memory.dmp

Download