cobaltstrike | 58637f1b136cf2f592b5871a00fc247aa45f6bf25f537211c043aa79bc845bb4 | Triage

Analysis

max time kernel
147s
max time network
148s
platform
windows10_x64
resource
win10v20210408
submitted
01-07-2021 07:17

Sharing

Report Analysis Logs

General

Target

58637f1b136cf2f592b5871a00fc247aa45f6bf25f537211c043aa79bc845bb4.exe
Size

345KB
MD5

7f18cbc582ab9004c8f44b1cff5b49f8
SHA1

4403ab3078c3e7d73dabb5710e0084bc7f5d509c
SHA256

58637f1b136cf2f592b5871a00fc247aa45f6bf25f537211c043aa79bc845bb4
SHA512

aad94e95bef0fbb170fa61dd6c60f12162509df4da9f9a42813a5da54cd1dd16f6d9862f76da25d4e80a224cb13f878665eaf324962e8fad7bbc7f55aac36a46

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1468 912 WerFault.exe 58637f1b136cf2f592b5871a00fc247aa45f6bf25f537211c043aa79bc845bb4.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1468 WerFault.exe
Token: SeBackupPrivilege 1468 WerFault.exe
Token: SeDebugPrivilege 1468 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\58637f1b136cf2f592b5871a00fc247aa45f6bf25f537211c043aa79bc845bb4.exe
"C:\Users\Admin\AppData\Local\Temp\58637f1b136cf2f592b5871a00fc247aa45f6bf25f537211c043aa79bc845bb4.exe"
1⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 508
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-114-0x00000000001C0000-0x00000000001F3000-memory.dmp

Filesize
204KB

Download
memory/912-116-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/912-115-0x00000000004C0000-0x000000000060A000-memory.dmp

Filesize
1.3MB

Download