cobaltstrike | 20cd8e26e41706c53fa0ffab1895da412a8d61d68d78640c1ed9595421ca0b03

Analysis

Target

20cd8e26e41706c53fa0ffab1895da412a8d61d68d78640c1ed9595421ca0b03.dll
Size

244KB
MD5

a1c09fa446adaf65195142a7191541ed
SHA1

6e0371850cf1bb2e60f4f053262d9d97abbac3fc
SHA256

20cd8e26e41706c53fa0ffab1895da412a8d61d68d78640c1ed9595421ca0b03
SHA512

d54cc22b82e27a7ead439f4b288d64516fd2267d2bd297cfbd031d35eb07205728897b705bf40c6a17d1f2b3a6f33c32952d77d59f5f9880bd0e4d127b9ae7e4

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1904 1932 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1904 WerFault.exe
1904 WerFault.exe
1904 WerFault.exe
1904 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1904 WerFault.exe

pid	pid_target	process	target process
1904	1932	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1904	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1932	748	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1904	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 1904	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 1904	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 1904	1932	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20cd8e26e41706c53fa0ffab1895da412a8d61d68d78640c1ed9595421ca0b03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20cd8e26e41706c53fa0ffab1895da412a8d61d68d78640c1ed9595421ca0b03.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 196
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1904

memory/1904-1-0x0000000000000000-mapping.dmp

Download
memory/1904-2-0x0000000000AA0000-0x0000000000AB1000-memory.dmp

Filesize
68KB

Download
memory/1904-4-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download
memory/1932-0-0x0000000000000000-mapping.dmp

Download
memory/1932-3-0x0000000000000000-mapping.dmp

Download