Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-11-2020 12:16

General

  • Target

    7c5a448ef79801222dceb3a09298423a.dll

  • Size

    208KB

  • MD5

    4bda250be73136628f57a0ed1d8969a1

  • SHA1

    d4c896cab15fde45c962353937b7f35f235a0576

  • SHA256

    f2728813e7147c34eeb0c734753e0360731b9995de11f8921bed0febfda4de29

  • SHA512

    49894fd6ddd49d1ea0ba3f377abf2e5537c0c543b16c45788d18c8c7bd907e7e5c8e7703e6e77ee200f7e5c44b1f1286cc523b72b386d5ca018cbb6b55e6cec8

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c5a448ef79801222dceb3a09298423a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c5a448ef79801222dceb3a09298423a.dll,#1
      2⤵
        PID:908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 664
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2976

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/908-0-0x0000000000000000-mapping.dmp

    • memory/908-4-0x0000000000000000-mapping.dmp

    • memory/908-3-0x0000000000000000-mapping.dmp

    • memory/908-5-0x0000000000000000-mapping.dmp

    • memory/908-6-0x0000000000000000-mapping.dmp

    • memory/2976-1-0x0000000004070000-0x0000000004071000-memory.dmp

      Filesize

      4KB

    • memory/2976-2-0x0000000004470000-0x0000000004471000-memory.dmp

      Filesize

      4KB

    • memory/2976-7-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

      Filesize

      4KB