Overview

overview

10

Static

static

a8979ed3eb...3b.exe

windows7_x64

10

a8979ed3eb...3b.exe

windows10_x64

10

Analysis

  • max time kernel
    20s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11/03/2021, 08:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a8979ed3ebb02513d366e126a8f5e2830f7590207dc30bb936fb0ddfe4bd543b.exe
  • Size 17KB
  • Sample210311-c19trqv1ka
  • SHA256 a8979ed3ebb02513d366e126a8f5e2830f7590207dc30bb936fb0ddfe4bd543b
  • MD5 SHA1 SHA512
Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8979ed3ebb02513d366e126a8f5e2830f7590207dc30bb936fb0ddfe4bd543b.exe
    "C:\Users\Admin\AppData\Local\Temp\a8979ed3ebb02513d366e126a8f5e2830f7590207dc30bb936fb0ddfe4bd543b.exe"
    1⤵
      PID:880
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 880 -s 1020
        2⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1404

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/880-2-0x0000000000140000-0x0000000000141000-memory.dmp
          Download

          memory/1404-3-0x000002ABDF390000-0x000002ABDF391000-memory.dmp
          Download