cobaltstrike | bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:56

Target
bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465.exe
Size 76KB
Sample260930-js2a6axvbz
SHA256 bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465
MD5 90a193219cd18d27e6665f3b0999d393
SHA1 b696e25336049c762e847f38fe3e7abf5429472a
SHA512 7e1a37dc89cb6e0df2d2f4dc65529607b58a6fe09f1668864cc40d3029d910d991836dbbfbefd2a51c3e61e3a551601d0c4636dfa2a8e16deb187e8f139a598e
SSDEEP 1536:lxgmwgJExtaTmQ6SG5ucZRjNvz4q7f/T+/63AW:lxgwEnkT6SGDrC8/T+6
TLSH
T11B73092E73A360FDC19AD27592D786B2DA72F8251131ABFE0395DA752F94C803F39610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Attributes

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
544	bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465.exe
544	bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465.exe

C:\Users\Admin\AppData\Local\Temp\bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465.exe
"C:\Users\Admin\AppData\Local\Temp\bd4c347dcf222cefb8fede75e13a77c4a8f871f5fc7c192a5a0d555da0f95465.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:544

memory/544-0-0x0000017174F80000-0x0000017174F81000-memory.dmp

Download

memory/544-1-0x00007FF717720000-0x00007FF717739000-memory.dmp

Download