4bf49bf71de958178160f5e5bc18f7f7967ee25492b52a72ebfb4ea8e4778aee | Triage

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
07-01-2021 11:42

Sharing

Report Analysis Logs

General

Target

cobaltstrike_shellcode_child1.bin.exe
Size

240KB
MD5

9646860e43223f6da940bf294661c374
SHA1

711d99b63ba69c622cc28ce6e3d3ff93426a646b
SHA256

4bf49bf71de958178160f5e5bc18f7f7967ee25492b52a72ebfb4ea8e4778aee
SHA512

1c0e40d19938533c393c35fd5188f58e52f16375cc79ab95b393dc66c0fde32658306b6277912979f0c3fcbc4ec349d96bd4ed8feb1f8eb0f954f168dac81405

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4020 480 WerFault.exe cobaltstrike_shellcode_child1.bin.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe
4020	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4020 WerFault.exe
Token: SeBackupPrivilege 4020 WerFault.exe
Token: SeDebugPrivilege 4020 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cobaltstrike_shellcode_child1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\cobaltstrike_shellcode_child1.bin.exe"
1⤵
PID:480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 244
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4020-2-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/4020-4-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download