cobaltstrike | 417abd1c1db6a5df3a86924f2263a684b58527dfbbada584ba3360f2c5462dfa | Triage

Analysis

max time kernel
90s
max time network
160s
platform
windows10_x64
resource
win10v20210410
submitted
30-06-2021 22:49

Sharing

Report Analysis Logs

General

Target

417abd1c1db6a5df3a86924f2263a684b58527dfbbada584ba3360f2c5462dfa.exe
Size

345KB
MD5

b10f6a5dc20e493d684999d006b53bbe
SHA1

2220c7327163012b08db53a1acece97ade29f26b
SHA256

417abd1c1db6a5df3a86924f2263a684b58527dfbbada584ba3360f2c5462dfa
SHA512

e7c1fc7ab53c4d108aa7b2acc84c0517e6789fa6f9b241704d6f85dd192a948b7f3bf0e3da5905785b9ad753fb9b1e6425c46663d3c1a1643a9242e0c91fb36f

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4092 1808 WerFault.exe 417abd1c1db6a5df3a86924f2263a684b58527dfbbada584ba3360f2c5462dfa.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe
4092	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4092 WerFault.exe
Token: SeBackupPrivilege 4092 WerFault.exe
Token: SeDebugPrivilege 4092 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\417abd1c1db6a5df3a86924f2263a684b58527dfbbada584ba3360f2c5462dfa.exe
"C:\Users\Admin\AppData\Local\Temp\417abd1c1db6a5df3a86924f2263a684b58527dfbbada584ba3360f2c5462dfa.exe"
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 508
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-115-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1808-114-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/1808-116-0x00000000001C0000-0x00000000001F3000-memory.dmp

Filesize
204KB

Download