cobaltstrike | ac8d61daf23ad3aa9e30f7a17d5c388804e60e7b9bfdabf4e947712cadc171f1

Analysis

Target

78aaad3ea096b7510a1bfafd222192a8.dll
Size

244KB
MD5

86fecd5319de131cc77ea78f56343288
SHA1

6c9253a388444aea7035e9292ff0f68ea1cd2a36
SHA256

ac8d61daf23ad3aa9e30f7a17d5c388804e60e7b9bfdabf4e947712cadc171f1
SHA512

06bf651bbc0c05e9a994384a8e0dd5aa1a5b0a228ce8fd8ece880f97364072972726715754768d885e831eaae9f996e7f36b477d1481a4c9b139871ad5f06ffd

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 276 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1744 WerFault.exe
1744 WerFault.exe
1744 WerFault.exe
1744 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1744 WerFault.exe

pid	pid_target	process	target process
1744	276	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1744	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 276	1640	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1744	276	rundll32.exe	WerFault.exe
PID 276 wrote to memory of 1744	276	rundll32.exe	WerFault.exe
PID 276 wrote to memory of 1744	276	rundll32.exe	WerFault.exe
PID 276 wrote to memory of 1744	276	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78aaad3ea096b7510a1bfafd222192a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78aaad3ea096b7510a1bfafd222192a8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 276 -s 196
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1744

memory/276-0-0x0000000000000000-mapping.dmp

Download
memory/276-3-0x0000000000000000-mapping.dmp

Download
memory/1744-1-0x0000000000000000-mapping.dmp

Download
memory/1744-2-0x0000000001ED0000-0x0000000001EE1000-memory.dmp

Filesize
68KB

Download
memory/1744-4-0x0000000002490000-0x00000000024A1000-memory.dmp

Filesize
68KB

Download