cobaltstrike | 7cd57ffb39c4dd953e8963ce4a3efe7f8c746fe818cd1fc1010ae90f818130e8 | Triage

Analysis

max time kernel
11s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
12-11-2020 13:50

Sharing

Report Analysis Logs

General

Target

7cd57ffb39c4dd953e8963ce4a3efe7f8c746fe818cd1fc1010ae90f818130e8.dll
Size

199KB
MD5

1c90d601ceb9064f920d1eb73940aeea
SHA1

79e3eeb484dfde1707d9fa3f9bc8194309a5950b
SHA256

7cd57ffb39c4dd953e8963ce4a3efe7f8c746fe818cd1fc1010ae90f818130e8
SHA512

fc42a1b063509ee0bf7dceca1f750f72655d747939bb7944e11eb10da5e043c8f552555cf48e3c3e949a094f6c585c6b3db623faa7a804570744b2aa794e2717

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

ServiceHost packer 3 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/672-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/672-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/672-4-0x0000000000000000-mapping.dmp	servicehost

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2964 672 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2964 WerFault.exe
Token: SeBackupPrivilege 2964 WerFault.exe
Token: SeDebugPrivilege 2964 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3648 wrote to memory of 672	3648	rundll32.exe	rundll32.exe
PID 3648 wrote to memory of 672	3648	rundll32.exe	rundll32.exe
PID 3648 wrote to memory of 672	3648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd57ffb39c4dd953e8963ce4a3efe7f8c746fe818cd1fc1010ae90f818130e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd57ffb39c4dd953e8963ce4a3efe7f8c746fe818cd1fc1010ae90f818130e8.dll,#1
2⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 632
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-0-0x0000000000000000-mapping.dmp

Download
memory/672-2-0x0000000000000000-mapping.dmp

Download
memory/672-3-0x0000000000000000-mapping.dmp

Download
memory/672-4-0x0000000000000000-mapping.dmp

Download
memory/2964-1-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/2964-6-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download