cobaltstrike | 2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538

Analysis

Target

2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll
Size

199KB
MD5

5d0bbc4db7f2771b87c4aa5389381a3a
SHA1

82a9e68b18f84c31b71cecbdf1f983067b70ec06
SHA256

2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538
SHA512

797052afcefd402423b9112aa968eaf9b7c2998f525ad9347ee86f4d0c8336f5f52ce9c5ba2a5c3bebe1b142fdc47b141414a0125e8e2fe1d3a285122bbb20a3

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/1868-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1868-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1868-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1868-5-0x0000000000000000-mapping.dmp	servicehost

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2924 1868 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2924	1868	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2924 WerFault.exe
Token: SeBackupPrivilege 2924 WerFault.exe
Token: SeDebugPrivilege 2924 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1868	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1868	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1868	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll,#1
  2⤵
  PID:1868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2924

memory/1868-0-0x0000000000000000-mapping.dmp

Download
memory/1868-3-0x0000000000000000-mapping.dmp

Download
memory/1868-4-0x0000000000000000-mapping.dmp

Download
memory/1868-2-0x0000000000000000-mapping.dmp

Download
memory/1868-5-0x0000000000000000-mapping.dmp

Download
memory/2924-1-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/2924-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download