cobaltstrike | f09511a7b731bba59d266c1be3fa6870a0d6008de5febf9ce9b6b59273237158

Analysis

Target

f09511a7b731bba59d266c1be3fa6870a0d6008de5febf9ce9b6b59273237158.dll
Size

244KB
MD5

2c70f37c51d5a3ccdd745e1e2b1239f1
SHA1

a55d12929e54dec5728cd5622935d7827d9097cf
SHA256

f09511a7b731bba59d266c1be3fa6870a0d6008de5febf9ce9b6b59273237158
SHA512

099dcf6c7cf64e4c3daf2cff2615e6a1830141427409a30f3a9dcd429192194fa5a3845d49568d7a4718be114cc3ae52e6688a2c749da73c7045b78e70f98728

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 1332 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1924 WerFault.exe

pid	pid_target	process	target process
1924	1332	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1924	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1332	796	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 1924	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1924	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1924	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1924	1332	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f09511a7b731bba59d266c1be3fa6870a0d6008de5febf9ce9b6b59273237158.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f09511a7b731bba59d266c1be3fa6870a0d6008de5febf9ce9b6b59273237158.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

memory/1332-0-0x0000000000000000-mapping.dmp

Download
memory/1332-3-0x0000000000000000-mapping.dmp

Download
memory/1924-1-0x0000000000000000-mapping.dmp

Download
memory/1924-2-0x0000000001F10000-0x0000000001F21000-memory.dmp

Filesize
68KB

Download
memory/1924-4-0x0000000002560000-0x0000000002571000-memory.dmp

Filesize
68KB

Download