cobaltstrike | b3ea9eca42e0ebad66eb7d6264cb6a59ca308ef9fd6b1cb074fbe13ffdc47ba1 | Triage

Analysis

max time kernel
13s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
12-11-2020 14:01

Sharing

Report Analysis Logs

General

Target

b3ea9eca42e0ebad66eb7d6264cb6a59ca308ef9fd6b1cb074fbe13ffdc47ba1.dll
Size

201KB
MD5

1d9d911337b1f29de9d70ad890b5a8ca
SHA1

cf21f2fd69518758e92293ae63f1317a5975e5db
SHA256

b3ea9eca42e0ebad66eb7d6264cb6a59ca308ef9fd6b1cb074fbe13ffdc47ba1
SHA512

1a60a719bed44551c5cafedde94d7eeb9e75b07fb2746ecf386ed3c8b25c62c8398bc651308b4d8e5c4dd5e154f5cbf9ead6384268c1a5b6fbd56569d786063f

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2880 1216 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2880 WerFault.exe
Token: SeBackupPrivilege 2880 WerFault.exe
Token: SeDebugPrivilege 2880 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1020 wrote to memory of 1216	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1216	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1216	1020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3ea9eca42e0ebad66eb7d6264cb6a59ca308ef9fd6b1cb074fbe13ffdc47ba1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3ea9eca42e0ebad66eb7d6264cb6a59ca308ef9fd6b1cb074fbe13ffdc47ba1.dll,#1
2⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 640
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000000000000-mapping.dmp

Download
memory/1216-2-0x0000000000000000-mapping.dmp

Download
memory/1216-3-0x0000000000000000-mapping.dmp

Download
memory/1216-4-0x0000000000000000-mapping.dmp

Download
memory/2880-1-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download
memory/2880-5-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download