cobaltstrike | f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:54

Target
f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba.exe
Size 24KB
Sample260811-2vmvnaem7z
SHA256 f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba
MD5 9323d8722612cd5c4db9e18195232e33
SHA1 a8e0eed36c914fd79f197eab95e1c15dbc92eb3c
SHA512 ce4d4542a2f1ad228d53d956dd5bab0b970d330887320da43490c50d663f04a0edd0764c77a158ac7cb6ec7081ff3aa0732d21483758165643a1c5b9d7ffb08b
SSDEEP 384:Xy9UNirVuRMS1jXhc9vkGW3nnsDyfUhdrAIUIYzpenJWzRWXa:sUNirVuRMEhcVkGWcOfZIUIEp86R
TLSH
T101B22A0F734364D8D51BD27896FBC736AAF2BC12182F5B2E0A60D3352E30DA45A39657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba.exe
4060	f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba.exe

C:\Users\Admin\AppData\Local\Temp\f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba.exe
"C:\Users\Admin\AppData\Local\Temp\f324323dcfb2de848e847fd9f3ac64b90bcef361a56ce273c86ca6fea313a5ba.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060

memory/4060-1-0x00007FFE49D50000-0x00007FFE49D7B000-memory.dmp

Download

memory/4060-0-0x00007FFE4D540000-0x00007FFE4D7A3000-memory.dmp

Download

memory/4060-2-0x00007FF6C03A0000-0x00007FF6C03AE000-memory.dmp

Download