cobaltstrike | 9f7dbca9473e170731126ec24542e29dd81c468a8b4c1cd9cfd88b048e30e657

Analysis

Target

9f7dbca9473e170731126ec24542e29dd81c468a8b4c1cd9cfd88b048e30e657.dll
Size

204KB
MD5

2af0472fb41dc374a7ba42b40c89ab1e
SHA1

20190a5f93334b6262b2994a5abbbd6c79e45c57
SHA256

9f7dbca9473e170731126ec24542e29dd81c468a8b4c1cd9cfd88b048e30e657
SHA512

c6374b2cf38bd7a2f9baea64877970136a0ab365e080c71ab4e140044b344b50a39b84842fc330125aaf95864dacc584795ebb59a55a57102fd4d7eac869ed1c

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 1916 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1988 WerFault.exe
1988 WerFault.exe
1988 WerFault.exe
1988 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1988 WerFault.exe

pid	pid_target	process	target process
1988	1916	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1988	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1916	596	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1988	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1988	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1988	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1988	1916	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f7dbca9473e170731126ec24542e29dd81c468a8b4c1cd9cfd88b048e30e657.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f7dbca9473e170731126ec24542e29dd81c468a8b4c1cd9cfd88b048e30e657.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1916

memory/1916-0-0x0000000000000000-mapping.dmp

Download
memory/1916-3-0x0000000000000000-mapping.dmp

Download
memory/1988-1-0x0000000000000000-mapping.dmp

Download
memory/1988-2-0x0000000002180000-0x0000000002191000-memory.dmp

Filesize
68KB

Download
memory/1988-4-0x0000000002670000-0x0000000002681000-memory.dmp

Filesize
68KB

Download