cobaltstrike | fb8acf77891e1897c9dcab222d5a9424e1fd4eb0273e0def4e2872bd870c9901 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-12-2021 21:19

Sharing

Report Analysis Logs

General

Target

a1d9d2b9440b1a33370302895edbf43b.exe
Size

278KB
MD5

a1d9d2b9440b1a33370302895edbf43b
SHA1

fce98aa07b88962d4768679b6dcc229e9df42233
SHA256

fb8acf77891e1897c9dcab222d5a9424e1fd4eb0273e0def4e2872bd870c9901
SHA512

9821d377b0c57a46ead06b2c2e90c66f21fdf315146a57161bae8116208c9ace35d5651398950be32b6d8bf68d99be42c26cffda6e17a8710cd7e41948ca0b6b

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2332 1804 WerFault.exe a1d9d2b9440b1a33370302895edbf43b.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2332 WerFault.exe
Token: SeBackupPrivilege 2332 WerFault.exe
Token: SeDebugPrivilege 2332 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a1d9d2b9440b1a33370302895edbf43b.exe
"C:\Users\Admin\AppData\Local\Temp\a1d9d2b9440b1a33370302895edbf43b.exe"
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 568
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-115-0x0000000000650000-0x000000000079A000-memory.dmp

Filesize
1.3MB

Download