cobaltstrike | 9cc76b0a3dc17a72375c3b9178405ab4969b77df0a50ef296b1f726f85268cd5

Analysis

Target

9cc76b0a3dc17a72375c3b9178405ab4969b77df0a50ef296b1f726f85268cd5.dll
Size

208KB
MD5

7c5a448ef79801222dceb3a09298423a
SHA1

bb60d90e70396b52d7d890abd738d796c454cde3
SHA256

9cc76b0a3dc17a72375c3b9178405ab4969b77df0a50ef296b1f726f85268cd5
SHA512

17ce0d08a97eec60a5dc9594ce79bca4aab06847bfa4dada2517b503dd7b21c8d1cf4c9d71b75741d49f32010ccf585a4a4938298a54fe0385d7283769c3b80c

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4168 4772 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4168	4772	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4168 WerFault.exe
Token: SeBackupPrivilege 4168 WerFault.exe
Token: SeDebugPrivilege 4168 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4684 wrote to memory of 4772	4684	rundll32.exe	rundll32.exe
PID 4684 wrote to memory of 4772	4684	rundll32.exe	rundll32.exe
PID 4684 wrote to memory of 4772	4684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cc76b0a3dc17a72375c3b9178405ab4969b77df0a50ef296b1f726f85268cd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cc76b0a3dc17a72375c3b9178405ab4969b77df0a50ef296b1f726f85268cd5.dll,#1
2⤵
PID:4772

memory/4168-1-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/4168-6-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/4772-0-0x0000000000000000-mapping.dmp

Download
memory/4772-2-0x0000000000000000-mapping.dmp

Download
memory/4772-3-0x0000000000000000-mapping.dmp

Download
memory/4772-4-0x0000000000000000-mapping.dmp

Download
memory/4772-5-0x0000000000000000-mapping.dmp

Download