cobaltstrike | 2db23dbabf20814d496c61778c178ecf7a0da76f199f5476f45b4bbd650a4dd4

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2db23dbabf20814d496c61778c178ecf7a0da76f199f5476f45b4bbd650a4dd4.exe
Size 19KB
Sample261003-vyc2astbpg
SHA256 2db23dbabf20814d496c61778c178ecf7a0da76f199f5476f45b4bbd650a4dd4
MD5 0b9bde384dac136914f21b8e5483c409
SHA1 25e750a10bc1d263e969d962f567fc55fbceff44
SHA512 2e1693d52bcf0da6940180380156c216cf3570c8b7bdb16b46f01bdc0962992e9c5352dccec5c250c8f267d723122795a2415751f14e16a0eb717ebef12f3cb2
SSDEEP 192:/V7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2dn9HysLn3WF8qa1Dojjgi:5qaCF31cix+Dc4zjInJ7LGFF46gi
TLSH
T19292D83FE31358E9C506D5B845FF3733DCB139B385A6A32E2724D2B42E106A46E6E610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery cobaltstrike trojan

Malware Config

Extracted

Family

cobaltstrike

http://39.100.66.238:80/GrLX

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2db23dbabf20814d496c61778c178ecf7a0da76f199f5476f45b4bbd650a4dd4.exe

C:\Users\Admin\AppData\Local\Temp\2db23dbabf20814d496c61778c178ecf7a0da76f199f5476f45b4bbd650a4dd4.exe
"C:\Users\Admin\AppData\Local\Temp\2db23dbabf20814d496c61778c178ecf7a0da76f199f5476f45b4bbd650a4dd4.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5636-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/5636-1-0x0000000000400000-0x000000000040C000-memory.dmp