cobaltstrike | 85c30b4e1dbec240d0021b6569173302b52143f5bb066218c19c0b5c6c22893e

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85c30b4e1dbec240d0021b6569173302b52143f5bb066218c19c0b5c6c22893e.exe
Size 3.3MB
Sample261012-s2mnsscs4w
SHA256 85c30b4e1dbec240d0021b6569173302b52143f5bb066218c19c0b5c6c22893e
MD5 4ec74cb52636b301b5546dcd2fea140f
SHA1 068c60ec313d37ec5f88e7b88ee726d01d31b82d
SHA512 772501dfe306190029d34bd7b852266a8515cf14d267c27acb47128f977393007300efc57b3b1f20c74c4f9f8c76fc1ad1bea4bbdf13ff0f24250b9c74fd1113
SSDEEP 49152:qIxI3RRvdrb/T0vO90dL3BmAFd4A64nsfJ/1jr1igvQwzq8lcMD19d41wifjdMWb:I3bjrEw2Id0FM2Pcd8
TLSH
T17EF56C43FC61A995CAEE913088A5829677713C484F7027CB6B14BBBD1A77BC01F793A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery cobaltstrike trojan

Malware Config

Extracted

Family

cobaltstrike

http://84.247.155.115:80/bU2t

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MANM; MANM)

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	85c30b4e1dbec240d0021b6569173302b52143f5bb066218c19c0b5c6c22893e.exe

C:\Users\Admin\AppData\Local\Temp\85c30b4e1dbec240d0021b6569173302b52143f5bb066218c19c0b5c6c22893e.exe
"C:\Users\Admin\AppData\Local\Temp\85c30b4e1dbec240d0021b6569173302b52143f5bb066218c19c0b5c6c22893e.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5952-0-0x000002D367820000-0x000002D367821000-memory.dmp

Download