cobaltstrike | 3e1d36766dfab3b000777a6c8a7742e3f454eb9270e835181cfb3ee04e8a1e62

Analysis

Target
lfuaqwpuz.dll
Size 516KB
Sample220324-sa1rcafcbr
SHA256 3e1d36766dfab3b000777a6c8a7742e3f454eb9270e835181cfb3ee04e8a1e62
MD5 8f42a7fb558edae380e2a8c4f4902b52
SHA1 d31d094799cfe75b24e4d89d7131d62adc5aca74
SHA512 9ce45ad47c3eacaa1c8fab38ff198ee45e714faa16a4cfbebbac2a3a46f9120134766f2c8df87843a5184a4c2d23fc9e89e17a3120bf94a4d7facc5f6ed82c7b
MD5 SHA1 SHA512

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	596	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2004	596	regsvr32.exe	29
PID 596 wrote to memory of 2004	596	regsvr32.exe	29
PID 596 wrote to memory of 2004	596	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lfuaqwpuz.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 596 -s 220
  2⤵
  - Program crash
  PID:2004

memory/596-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Download

memory/596-55-0x0000000001ED0000-0x0000000001F11000-memory.dmp

Download

memory/596-57-0x0000000001E80000-0x0000000001ECD000-memory.dmp

Download