Analysis
-
max time kernel
112s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
07-01-2021 11:42
General
-
Target
cobaltstrike_shellcode_child1.bin.exe
-
Size
240KB
-
MD5
9646860e43223f6da940bf294661c374
-
SHA1
711d99b63ba69c622cc28ce6e3d3ff93426a646b
-
SHA256
4bf49bf71de958178160f5e5bc18f7f7967ee25492b52a72ebfb4ea8e4778aee
-
SHA512
1c0e40d19938533c393c35fd5188f58e52f16375cc79ab95b393dc66c0fde32658306b6277912979f0c3fcbc4ec349d96bd4ed8feb1f8eb0f954f168dac81405
Score
10/10
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cobaltstrike_shellcode_child1.bin.exe"C:\Users\Admin\AppData\Local\Temp\cobaltstrike_shellcode_child1.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1312-2-0x0000000000000000-mapping.dmp
-
memory/1312-3-0x0000000001FE0000-0x0000000001FF1000-memory.dmpFilesize
68KB
-
memory/1312-4-0x0000000002440000-0x0000000002451000-memory.dmpFilesize
68KB
-
memory/1312-5-0x0000000001FE0000-0x0000000001FF1000-memory.dmpFilesize
68KB