cobaltstrike | bb05c030a21720c072ae4f78bf6077f69fd29230bcfa72cbcb81759314ab7a9b | Triage

Analysis

max time kernel
15s
max time network
119s
platform
windows10_x64
resource
win10v20210408
submitted
22-06-2021 16:53

Sharing

Report Analysis Logs

General

Target

bb05c030a21720c072ae4f78bf6077f69fd29230bcfa72cbcb81759314ab7a9b.exe
Size

316KB
MD5

9dae4e9da679c688a819c8d3c78ffa86
SHA1

f644230915006bc1c5505cf19569759a487fc33a
SHA256

bb05c030a21720c072ae4f78bf6077f69fd29230bcfa72cbcb81759314ab7a9b
SHA512

36dee115805b46c319bcc5f6aad70f8b3c7b02f34c031883ee5a3a5b9d3820397f63e4a0e597230b11386b3bc78494b18490c40393fcfc257334501ed02ef6e0

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 992 WerFault.exe bb05c030a21720c072ae4f78bf6077f69fd29230bcfa72cbcb81759314ab7a9b.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 852 WerFault.exe
Token: SeBackupPrivilege 852 WerFault.exe
Token: SeDebugPrivilege 852 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bb05c030a21720c072ae4f78bf6077f69fd29230bcfa72cbcb81759314ab7a9b.exe
"C:\Users\Admin\AppData\Local\Temp\bb05c030a21720c072ae4f78bf6077f69fd29230bcfa72cbcb81759314ab7a9b.exe"
1⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 516
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-114-0x00000000021A0000-0x00000000021E7000-memory.dmp

Filesize
284KB

Download
memory/992-115-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/992-116-0x0000000002370000-0x00000000023A3000-memory.dmp

Filesize
204KB

Download