cobaltstrike | 673542f36f5e0b782a9347ed5ea4af1d35a449c9f1431b5b0acfb6a389497630 | Triage

Analysis

max time kernel
17s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
22-06-2021 14:39

Sharing

Report Analysis Logs

General

Target

673542f36f5e0b782a9347ed5ea4af1d35a449c9f1431b5b0acfb6a389497630.exe
Size

316KB
MD5

e0c594aad75d49b277efe6f4fa09e8af
SHA1

0f62796ca62ee701c494709dbda8c1e26f380843
SHA256

673542f36f5e0b782a9347ed5ea4af1d35a449c9f1431b5b0acfb6a389497630
SHA512

f583a265a33c447626401119292e518fbb16a5e01a20616c254b12de82447aa83c6b6ed1cbc02c5a8e3ed20482c489a71e55fb14cc52cfb59956377be06082eb

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3968 640 WerFault.exe 673542f36f5e0b782a9347ed5ea4af1d35a449c9f1431b5b0acfb6a389497630.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3968 WerFault.exe
Token: SeBackupPrivilege 3968 WerFault.exe
Token: SeDebugPrivilege 3968 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\673542f36f5e0b782a9347ed5ea4af1d35a449c9f1431b5b0acfb6a389497630.exe
"C:\Users\Admin\AppData\Local\Temp\673542f36f5e0b782a9347ed5ea4af1d35a449c9f1431b5b0acfb6a389497630.exe"
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 512
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-114-0x00000000004C0000-0x000000000056E000-memory.dmp

Filesize
696KB

Download
memory/640-115-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/640-116-0x00000000021F0000-0x0000000002223000-memory.dmp

Filesize
204KB

Download