cobaltstrike | 3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 21:48

Target
3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9.exe
Size 356KB
Sample260809-1n7e2swejg
SHA256 3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9
MD5 064f1b7dcaf2c7d33d3ed67360ae22df
SHA1 c711feed9e58f42a58920b1617aa6a12d5901655
SHA512 f387e29179793da05523708a84e35b2b45dc20f0bdf36f8a8193d8c965f573b757b0b86b9520c63df8eb718784c7cd793ba67b564b3df37a04b6706cf5956e8a
SSDEEP 6144:Kdbu1J7PCaXxMLGxKWR1mlkVl+lIzohdMxB+RNGrQLFR461+nO7zs0IBVLZ:muqyxMLNplyon0BB
TLSH
T10A743938BA25DCE4CB2FB1B489212E4551713C0B8730E69FA68565DB5E372D0EF3D928
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Attributes

user_agent
Host: webcdns.com Connection: close Accept: image/* User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9.exe
4292	3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9.exe

C:\Users\Admin\AppData\Local\Temp\3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9.exe
"C:\Users\Admin\AppData\Local\Temp\3a1eade15701436ab1b04c7a3294a6ccbfb234d42aedd0cf0eeaa07ace3d42c9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4292-0-0x0000024B89FC0000-0x0000024B89FC1000-memory.dmp

Download