cobaltstrike | 3734d797c5f3ad3fe1211802b686c8b7453c410e8222c049092988e12a9b0dae | Triage

Analysis

max time kernel
93s
max time network
112s
platform
windows10_x64
resource
win10v20210410
submitted
01-07-2021 07:15

Sharing

Report Analysis Logs

General

Target

3734d797c5f3ad3fe1211802b686c8b7453c410e8222c049092988e12a9b0dae.exe
Size

345KB
MD5

93e38628be9ad530506023bf708dd049
SHA1

517f938f319d3844b5a704ea9570cfa28275c766
SHA256

3734d797c5f3ad3fe1211802b686c8b7453c410e8222c049092988e12a9b0dae
SHA512

d43d686bb6e3f2f17b8d2ba04fa1506216a1adfc500411f07f82c96121fa882b827ad24291c7e42f7af611cea57318fd113f09d39d909fff5e28c77bcedadec1

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3384 3908 WerFault.exe 3734d797c5f3ad3fe1211802b686c8b7453c410e8222c049092988e12a9b0dae.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe
3384	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3384 WerFault.exe
Token: SeBackupPrivilege 3384 WerFault.exe
Token: SeDebugPrivilege 3384 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3734d797c5f3ad3fe1211802b686c8b7453c410e8222c049092988e12a9b0dae.exe
"C:\Users\Admin\AppData\Local\Temp\3734d797c5f3ad3fe1211802b686c8b7453c410e8222c049092988e12a9b0dae.exe"
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 508
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3908-115-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3908-114-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/3908-116-0x00000000001C0000-0x00000000001F3000-memory.dmp

Filesize
204KB

Download