Analysis

  • max time kernel
    135s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-11-2020 23:15

General

  • Target

    2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll

  • Size

    199KB

  • MD5

    5d0bbc4db7f2771b87c4aa5389381a3a

  • SHA1

    82a9e68b18f84c31b71cecbdf1f983067b70ec06

  • SHA256

    2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538

  • SHA512

    797052afcefd402423b9112aa968eaf9b7c2998f525ad9347ee86f4d0c8336f5f52ce9c5ba2a5c3bebe1b142fdc47b141414a0125e8e2fe1d3a285122bbb20a3

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • ServiceHost packer 4 IoCs

    Detects ServiceHost packer used for .NET malware

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll,#1
      2⤵
        PID:1868
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 660
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2924

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1868-0-0x0000000000000000-mapping.dmp

    • memory/1868-3-0x0000000000000000-mapping.dmp

    • memory/1868-4-0x0000000000000000-mapping.dmp

    • memory/1868-2-0x0000000000000000-mapping.dmp

    • memory/1868-5-0x0000000000000000-mapping.dmp

    • memory/2924-1-0x00000000042D0000-0x00000000042D1000-memory.dmp

      Filesize

      4KB

    • memory/2924-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

      Filesize

      4KB