cobaltstrike | 8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d.exe
Size 356KB
Sample260501-xtdhdabx2t
SHA256 8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d
MD5 629134bd1d2524fc272033ede1c61295
SHA1 89f5421b8d4f69ce8cf7797dd86ddcbeb298ecc7
SHA512 75688653fb9b514bc438ea362992c29558fead70a4798bd60ab031dcdae0678b2e61e5414acbd3398adb157e67c99b13970e3dab0fdb8d9e580b649cb29a1873
SSDEEP 6144:Kdbu1J7PCaXxMLGxKWR1mlkVl+lIzohdMxB+RNGrQLFR461+nO7zs0IBVLG:muqyxMLNplyon0BB
TLSH
T186743938BA65DCE4CB2FB1B489212E4551713C0B8730E69FA68525DB5E372D0EF3D928
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor cobaltstrike trojan

Malware Config

Extracted

Family

cobaltstrike

http://webcdns.com:2083/static-directory/lt.mp3

Attributes

user_agent
Host: webcdns.com Connection: close Accept: image/* User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4324	8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d.exe
4324	8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d.exe

C:\Users\Admin\AppData\Local\Temp\8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d.exe
"C:\Users\Admin\AppData\Local\Temp\8981bb78c54bfd123ba796c5ef8aa55023d42d61576e5221cb5ebf31e490909d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4324-0-0x00000233F7F60000-0x00000233F7F61000-memory.dmp

Download

memory/4324-1-0x00000233F7E30000-0x00000233F7F5A000-memory.dmp

Download

memory/4324-13-0x00000233F7E30000-0x00000233F7F5A000-memory.dmp

Download