cobaltstrike | 39f710e9b910828fc0297e75e542e295e9421a5133d6f663c930cef9d1024a85

Analysis

Target

39f710e9b910828fc0297e75e542e295e9421a5133d6f663c930cef9d1024a85.dll
Size

206KB
MD5

dd46c5fd32f4576d9575b79797c64c45
SHA1

3b6b6ce3118fc4db4815d0c6b8c4f66d46ea2e25
SHA256

39f710e9b910828fc0297e75e542e295e9421a5133d6f663c930cef9d1024a85
SHA512

dec68404f985337d8d2f77c871beb2afb6239f521d91af1681cd5453ee9e9cc72fe8c7b63ff2b812abd5666801ccb0c98bea0384344e85646a4020515621aaf6

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3080 4816 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3080	4816	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3080 WerFault.exe
Token: SeBackupPrivilege 3080 WerFault.exe
Token: SeDebugPrivilege 3080 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4756 wrote to memory of 4816	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 4816	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 4816	4756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39f710e9b910828fc0297e75e542e295e9421a5133d6f663c930cef9d1024a85.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39f710e9b910828fc0297e75e542e295e9421a5133d6f663c930cef9d1024a85.dll,#1
2⤵
PID:4816

memory/3080-1-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/3080-6-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/4816-0-0x0000000000000000-mapping.dmp

Download
memory/4816-2-0x0000000000000000-mapping.dmp

Download
memory/4816-3-0x0000000000000000-mapping.dmp

Download
memory/4816-4-0x0000000000000000-mapping.dmp

Download
memory/4816-5-0x0000000000000000-mapping.dmp

Download