Analyzing CobaltStrike from PCAP

I am playing around with PCAPS on [Malware-Traffic-Analysis.net](https://Malware-Traffic-Analysis.net). I started with the first exercise 'BurninCandle'. I looked at the answers and pretty much got all the information except the part where it says IP for CobaltStrike. I marked the IP as suspicious but idk how they concluded it to be CobaltStrike. Any help is appreciated!

[\[link to exercise\]](https://www.malware-traffic-analysis.net/2022/03/21/index3.html)

cobaltstrike malware pcap