cobaltstrike | 1672ce53464329f5bd8d8039606f782d4958fa5541932e2b1726bdcedc0b0d88

Resubmissions

27/08/2021, 12:04

30/07/2021, 20:47

Target
spot.dll
Size 166KB
Sample210827-hvy113ngfa
SHA256 1672ce53464329f5bd8d8039606f782d4958fa5541932e2b1726bdcedc0b0d88
MD5 447a4fb533c755ccdab14a47f08a9ee0
SHA1 54af5273f126d3b956b3586732653750019ef3e4
SHA512 dd0df7c5b5bc320a065040e2d6f620eb6369feb0742747ebbbfee695fd21d40d15543244b43d2752764d7a08b39212a967e6ba6771aed6be2d9037c53a165920
MD5 SHA1 SHA512

Score

10^/10

Family

Attributes

user_agent
Host: mail.ru Connection: close Accept: image/jpeg User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3896 created 3008	3896	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3896	3008	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 15 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\spot.dll
1⤵
PID:3008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3008 -s 1324
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3896

memory/3008-114-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/3008-115-0x0000000003190000-0x0000000003590000-memory.dmp

Download