cobaltstrike | e05e0fcddebb17c98561067746781d0cac730586600ac05f9f46f7e987c7a4ad

Analysis

Target

e05e0fcddebb17c98561067746781d0cac730586600ac05f9f46f7e987c7a4ad.dll
Size

199KB
MD5

7366957065bccb45c383967ab76f1870
SHA1

e30ae0f6300dac262a5cbf14fafdf314ae1cf86a
SHA256

e05e0fcddebb17c98561067746781d0cac730586600ac05f9f46f7e987c7a4ad
SHA512

ae8647df25d20690195499d4800647129c6aaa2d00efb19d79fc83a5126d0d33d0c6ead98bf309bbfb7bf101bcebf7ba1b890a7eedd55be97040e973b271e858

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/3420-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3420-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3420-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3420-5-0x0000000000000000-mapping.dmp	servicehost

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2656 3420 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2656	3420	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2656 WerFault.exe
Token: SeBackupPrivilege 2656 WerFault.exe
Token: SeDebugPrivilege 2656 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 540 wrote to memory of 3420	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 3420	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 3420	540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e05e0fcddebb17c98561067746781d0cac730586600ac05f9f46f7e987c7a4ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e05e0fcddebb17c98561067746781d0cac730586600ac05f9f46f7e987c7a4ad.dll,#1
2⤵
PID:3420

memory/2656-1-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/2656-6-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3420-0-0x0000000000000000-mapping.dmp

Download
memory/3420-3-0x0000000000000000-mapping.dmp

Download
memory/3420-2-0x0000000000000000-mapping.dmp

Download
memory/3420-4-0x0000000000000000-mapping.dmp

Download
memory/3420-5-0x0000000000000000-mapping.dmp

Download