cobaltstrike | d1933850d05d345bc57356333ebe41446a5e1f7a7b09626a6906202f174852c1 | Triage

Analysis

max time kernel
134s
max time network
166s
platform
windows7_x64
resource
win7v20210408
submitted
30-07-2021 15:25

Sharing

Report Analysis Logs

General

Target

1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll
Size

380KB
MD5

3a11f98d3d4fb8df67c97dc1bd06ff2e
SHA1

c3e206b0babe20ffd9663a4e28272ef6c24bab8a
SHA256

1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
SHA512

bbc4bf5b0d7d4a303f19f33f7065fc2ca2c40590baf8a7d7994344c8f1c76f2e756ed5892f36b1743546ba2460e13f599825b551306a3773cb9570f6bc626d52

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 1984	1832	rundll32.exe	26
PID 1832 set thread context of 1980	1832	rundll32.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1984	1832	rundll32.exe	26
PID 1832 wrote to memory of 1984	1832	rundll32.exe	26
PID 1832 wrote to memory of 1984	1832	rundll32.exe	26
PID 1832 wrote to memory of 1984	1832	rundll32.exe	26
PID 1832 wrote to memory of 1980	1832	rundll32.exe	27
PID 1832 wrote to memory of 1980	1832	rundll32.exe	27
PID 1832 wrote to memory of 1980	1832	rundll32.exe	27
PID 1832 wrote to memory of 1980	1832	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\splwow64.exe
  "C:\Windows\splwow64.exe"
  2⤵
  PID:1984
- C:\Windows\splwow64.exe
  "C:\Windows\splwow64.exe"
  2⤵
  PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-59-0x0000000076DB0000-0x0000000076F59000-memory.dmp

Filesize
1.7MB

Download
memory/1832-60-0x0000000076B90000-0x0000000076CAF000-memory.dmp

Filesize
1.1MB

Download
memory/1980-65-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/1984-62-0x00000000000D0000-0x0000000000111000-memory.dmp

Filesize
260KB

Download