cobaltstrike | d1933850d05d345bc57356333ebe41446a5e1f7a7b09626a6906202f174852c1 | Triage

Analysis

max time kernel
137s
max time network
142s
platform
windows10_x64
resource
win10v20210410
submitted
30-07-2021 15:25

Sharing

Report Analysis Logs

General

Target

1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll
Size

380KB
MD5

3a11f98d3d4fb8df67c97dc1bd06ff2e
SHA1

c3e206b0babe20ffd9663a4e28272ef6c24bab8a
SHA256

1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f
SHA512

bbc4bf5b0d7d4a303f19f33f7065fc2ca2c40590baf8a7d7994344c8f1c76f2e756ed5892f36b1743546ba2460e13f599825b551306a3773cb9570f6bc626d52

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4028 created 2732	4028	WerFault.exe	76

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 2732	3244	rundll32.exe	76
PID 3244 set thread context of 2624	3244	rundll32.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4028	2732	WerFault.exe	76

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2732	3244	rundll32.exe	76
PID 3244 wrote to memory of 2732	3244	rundll32.exe	76
PID 3244 wrote to memory of 2732	3244	rundll32.exe	76
PID 3244 wrote to memory of 2624	3244	rundll32.exe	81
PID 3244 wrote to memory of 2624	3244	rundll32.exe	81
PID 3244 wrote to memory of 2624	3244	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\splwow64.exe
  "C:\Windows\splwow64.exe"
  2⤵
  PID:2732
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2732 -s 8
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:4028
- C:\Windows\splwow64.exe
  "C:\Windows\splwow64.exe"
  2⤵
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-117-0x0000000000F60000-0x0000000000FA1000-memory.dmp

Filesize
260KB

Download
memory/3244-115-0x00007FF9F5D40000-0x00007FF9F5DEE000-memory.dmp

Filesize
696KB

Download
memory/3244-114-0x00007FF9F8720000-0x00007FF9F88FB000-memory.dmp

Filesize
1.9MB

Download