cobaltstrike | 0dcff15e586c8e6db6d9c367bf392733937a66eb4e3d24673d81f93f5b0afd90 | Triage

Analysis

max time kernel
16s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
22-06-2021 16:52

Sharing

Report Analysis Logs

General

Target

0dcff15e586c8e6db6d9c367bf392733937a66eb4e3d24673d81f93f5b0afd90.exe
Size

316KB
MD5

eda8cf8b8bc38612aa47c55ae436d498
SHA1

3faef91f39eff32a57e3426cef1989bb5c5c7ed1
SHA256

0dcff15e586c8e6db6d9c367bf392733937a66eb4e3d24673d81f93f5b0afd90
SHA512

5b6c9724fac59e39123316a2ca5e635e019190fb5056f74654544ad8faa071432103bcde4cab80753da388f54256077d96406c78d7f29b264b1aac6ff8fa858f

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 3128 WerFault.exe 0dcff15e586c8e6db6d9c367bf392733937a66eb4e3d24673d81f93f5b0afd90.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2700 WerFault.exe
Token: SeBackupPrivilege 2700 WerFault.exe
Token: SeDebugPrivilege 2700 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0dcff15e586c8e6db6d9c367bf392733937a66eb4e3d24673d81f93f5b0afd90.exe
"C:\Users\Admin\AppData\Local\Temp\0dcff15e586c8e6db6d9c367bf392733937a66eb4e3d24673d81f93f5b0afd90.exe"
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 512
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-114-0x00000000005C0000-0x0000000000607000-memory.dmp

Filesize
284KB

Download
memory/3128-115-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3128-116-0x00000000020E0000-0x0000000002113000-memory.dmp

Filesize
204KB

Download