cobaltstrike | 2941c95c651a851d37fa94083c9a60738652ea70fb6f8f4e43c3433dae5e43e8 | Triage

Analysis

max time kernel
122s
max time network
139s
platform
windows10_x64
resource
win10-en-20211208
submitted
31-01-2022 04:10

Sharing

Report Analysis Logs

General

Target

2941c95c651a851d37fa94083c9a60738652ea70fb6f8f4e43c3433dae5e43e8.exe
Size

549KB
MD5

4e4db89841979de3205906411986b07d
SHA1

74d600fc823f74b6468cb741062ee5012761aeff
SHA256

2941c95c651a851d37fa94083c9a60738652ea70fb6f8f4e43c3433dae5e43e8
SHA512

504ecb874c9d070b39081256c543a04b4ec12ba405ecbbff8fe670d364140fad4814fb7648e99f608a4a1d720a644882d28a8931db6eeb54abb611d697db9cd9

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 2764 WerFault.exe 2941c95c651a851d37fa94083c9a60738652ea70fb6f8f4e43c3433dae5e43e8.exe

C:\Users\Admin\AppData\Local\Temp\2941c95c651a851d37fa94083c9a60738652ea70fb6f8f4e43c3433dae5e43e8.exe
"C:\Users\Admin\AppData\Local\Temp\2941c95c651a851d37fa94083c9a60738652ea70fb6f8f4e43c3433dae5e43e8.exe"
1⤵
PID:2764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2764 -s 204
2⤵
- Program crash
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-115-0x0000000140000000-0x0000000140062000-memory.dmp

Filesize
392KB

Download
memory/2764-121-0x00000000001A0000-0x00000000001FF000-memory.dmp

Filesize
380KB

Download