cobaltstrike | 530498bb81d7f7de78f575088b322e337e36554cc9ccf49a69be565e0fd2004d

Analysis

Target

530498bb81d7f7de78f575088b322e337e36554cc9ccf49a69be565e0fd2004d.dll
Size

244KB
MD5

8d9a02c042039adbe81f88e8fad8e3df
SHA1

df5affcefe0c7e4d80edf3a44966f8c2bef86025
SHA256

530498bb81d7f7de78f575088b322e337e36554cc9ccf49a69be565e0fd2004d
SHA512

c0181c18ec0eb1f65a6d29d5e87019ab8320399e6873b37cd4c0a6502de3b64932a6b54df00d30c5c23baf7496c8cd83f8a62fefba2cc6d1fc1fd265f83bbc25

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 2000 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1092 WerFault.exe

pid	pid_target	process	target process
1092	2000	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1092	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 2000	1084	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1092	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1092	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1092	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1092	2000	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\530498bb81d7f7de78f575088b322e337e36554cc9ccf49a69be565e0fd2004d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\530498bb81d7f7de78f575088b322e337e36554cc9ccf49a69be565e0fd2004d.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2000

memory/1092-1-0x0000000000000000-mapping.dmp

Download
memory/1092-2-0x0000000002170000-0x0000000002181000-memory.dmp

Filesize
68KB

Download
memory/1092-4-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download
memory/2000-0-0x0000000000000000-mapping.dmp

Download
memory/2000-3-0x0000000000000000-mapping.dmp

Download