cobaltstrike | b42f4e00fd5806d8d176713db7f7c05b35c522c4f589e7a0eeba23bf9afbb777

Analysis

Target

562893fef79989aecf27f035d8df4a82.dll
Size

244KB
MD5

95edddc2ba7770314faac11a8e5fc9f0
SHA1

1fd0bf07054ce2ac05c34d0bd1b6098f0b2732d5
SHA256

b42f4e00fd5806d8d176713db7f7c05b35c522c4f589e7a0eeba23bf9afbb777
SHA512

3bec77e8861cdcf803dd5c80ab0fce33a206fdc190b901cd9e5bbe4f69df8a18c8fa59faf3bee58010417d1fc0a42ea8df3e61c439d71ba5e314943b4eefb94d

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1116 1520 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1116 WerFault.exe
1116 WerFault.exe
1116 WerFault.exe
1116 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1116 WerFault.exe

pid	pid_target	process	target process
1116	1520	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1116	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1520	1960	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1116	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1116	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1116	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1116	1520	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\562893fef79989aecf27f035d8df4a82.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\562893fef79989aecf27f035d8df4a82.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

memory/1116-1-0x0000000000000000-mapping.dmp

Download
memory/1116-2-0x0000000000840000-0x0000000000851000-memory.dmp

Filesize
68KB

Download
memory/1116-4-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/1520-0-0x0000000000000000-mapping.dmp

Download
memory/1520-3-0x0000000000000000-mapping.dmp

Download