cobaltstrike | 0f9bfd21c33cf45c6d02b7066632284bd4126738ce879d7ff01cdb274c60524d

Analysis

Target

0f9bfd21c33cf45c6d02b7066632284bd4126738ce879d7ff01cdb274c60524d.dll
Size

244KB
MD5

b2830ef3bc9e95316fd393b000ef0dee
SHA1

d45ec7c9865b2230b097ebdec7aa181b5cd1796c
SHA256

0f9bfd21c33cf45c6d02b7066632284bd4126738ce879d7ff01cdb274c60524d
SHA512

558ebd4eb5ce5c029727f6839c13f05d46b1bd60d089b749120c94b3d140e0c37a58587ef1f1d06dad634cdc331fafbb2448693001599718f512401d95e4e996

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 2028 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2040 WerFault.exe

pid	pid_target	process	target process
2040	2028	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2040	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2028	1120	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 2040	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2040	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2040	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2040	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9bfd21c33cf45c6d02b7066632284bd4126738ce879d7ff01cdb274c60524d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9bfd21c33cf45c6d02b7066632284bd4126738ce879d7ff01cdb274c60524d.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

memory/2028-0-0x0000000000000000-mapping.dmp

Download
memory/2028-3-0x0000000000000000-mapping.dmp

Download
memory/2040-1-0x0000000000000000-mapping.dmp

Download
memory/2040-2-0x0000000001FC0000-0x0000000001FD1000-memory.dmp

Filesize
68KB

Download
memory/2040-4-0x00000000025B0000-0x00000000025C1000-memory.dmp

Filesize
68KB

Download