cobaltstrike | a87375528edbfafb13e9c33266e3e47ef03f452c1f854f4297c43d125fe6dfff | Triage

Analysis

max time kernel
12s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
22-06-2021 14:39

Sharing

Report Analysis Logs

General

Target

a87375528edbfafb13e9c33266e3e47ef03f452c1f854f4297c43d125fe6dfff.exe
Size

316KB
MD5

985a7a358c6415adf6fb39828c8525ad
SHA1

62deffa2f57c3bfd5fd8bcb8acc0f7dbe656f82c
SHA256

a87375528edbfafb13e9c33266e3e47ef03f452c1f854f4297c43d125fe6dfff
SHA512

fd28e2a871a5baeca515feeaff1053d177b52c055b18282690956d509e5ef43264862f845233b94d3cda1f36100f1491681182e3386ad4a9055d70a0854f5495

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 772 WerFault.exe a87375528edbfafb13e9c33266e3e47ef03f452c1f854f4297c43d125fe6dfff.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2872 WerFault.exe
Token: SeBackupPrivilege 2872 WerFault.exe
Token: SeDebugPrivilege 2872 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a87375528edbfafb13e9c33266e3e47ef03f452c1f854f4297c43d125fe6dfff.exe
"C:\Users\Admin\AppData\Local\Temp\a87375528edbfafb13e9c33266e3e47ef03f452c1f854f4297c43d125fe6dfff.exe"
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 512
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-114-0x0000000002230000-0x0000000002263000-memory.dmp

Filesize
204KB

Download
memory/772-115-0x00000000004F0000-0x000000000063A000-memory.dmp

Filesize
1.3MB

Download
memory/772-116-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download