cobaltstrike | 9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3

Analysis

Target

9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3.dll
Size

208KB
MD5

3b938742cb476f22f9a8cb10f56e49c1
SHA1

b42eaf210ca625cbd9ea0be256e7c9c3f60aaa77
SHA256

9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3
SHA512

cfae784948a4f7164925f94fe57d2dddd41150d45900041e36022192fe379377dbbf7a2cd357551ffb5da5a1359efa769c07b8f64b3c7ae71cb4d5139e7867ce

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/4028-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4028-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4028-5-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4028-3-0x0000000000000000-mapping.dmp	servicehost

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 4028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1528	4028	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1528 WerFault.exe
Token: SeBackupPrivilege 1528 WerFault.exe
Token: SeDebugPrivilege 1528 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3284 wrote to memory of 4028	3284	rundll32.exe	rundll32.exe
PID 3284 wrote to memory of 4028	3284	rundll32.exe	rundll32.exe
PID 3284 wrote to memory of 4028	3284	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3.dll,#1
2⤵
PID:4028

memory/1528-1-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/1528-6-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4028-0-0x0000000000000000-mapping.dmp

Download
memory/4028-2-0x0000000000000000-mapping.dmp

Download
memory/4028-4-0x0000000000000000-mapping.dmp

Download
memory/4028-5-0x0000000000000000-mapping.dmp

Download
memory/4028-3-0x0000000000000000-mapping.dmp

Download