cobaltstrike | 83672444b1fa6ec5a69b5fd0c06603c4fc4a87e35e04095a9653e19f657c496b

Analysis

Target

83672444b1fa6ec5a69b5fd0c06603c4fc4a87e35e04095a9653e19f657c496b.dll
Size

244KB
MD5

51e0e3b8aaff688cf4287aec0fd84790
SHA1

c0d4493834925e65a93e81fc4b257d6a799d20c1
SHA256

83672444b1fa6ec5a69b5fd0c06603c4fc4a87e35e04095a9653e19f657c496b
SHA512

5e8f0950274617eaf87ba12800123dedf2cbc63c8f99f2aec0672e6c994a544e76f89525b6bde77eca31ddfd537dba1cad7243a58a354e659f279ee7641364ce

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1392 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2028 WerFault.exe
2028 WerFault.exe
2028 WerFault.exe
2028 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2028 WerFault.exe

pid	pid_target	process	target process
2028	1392	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2028	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1392	1632	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 2028	1392	rundll32.exe	WerFault.exe
PID 1392 wrote to memory of 2028	1392	rundll32.exe	WerFault.exe
PID 1392 wrote to memory of 2028	1392	rundll32.exe	WerFault.exe
PID 1392 wrote to memory of 2028	1392	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83672444b1fa6ec5a69b5fd0c06603c4fc4a87e35e04095a9653e19f657c496b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83672444b1fa6ec5a69b5fd0c06603c4fc4a87e35e04095a9653e19f657c496b.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

memory/1392-0-0x0000000000000000-mapping.dmp

Download
memory/1392-3-0x0000000000000000-mapping.dmp

Download
memory/2028-1-0x0000000000000000-mapping.dmp

Download
memory/2028-2-0x0000000001FD0000-0x0000000001FE1000-memory.dmp

Filesize
68KB

Download
memory/2028-4-0x0000000002560000-0x0000000002571000-memory.dmp

Filesize
68KB

Download