cobaltstrike | 02e7136ae3e0962597f69aa29c25231cc3fc54039b450c3f9eaaf8cc28bfba9c | Triage

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-05-2022 02:21

Sharing

Report Analysis Logs

General

Target

02e7136ae3e0962597f69aa29c25231cc3fc54039b450c3f9eaaf8cc28bfba9c.exe
Size

251KB
MD5

f45035565475057e5ecbc174ba8e24de
SHA1

c270cf1b4ef86eafbd4e627571a10fde03e06c86
SHA256

02e7136ae3e0962597f69aa29c25231cc3fc54039b450c3f9eaaf8cc28bfba9c
SHA512

6ea01279491b16b392631386a2c3f63cc18965704ca14eefc153b03a5b27e2b8b40d90a4010fad6b47069e621bcbceabd13e917e6df40ab613c8a9724d21aca7

Score

10^/10

cobaltstrike metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4296 1888 WerFault.exe 02e7136ae3e0962597f69aa29c25231cc3fc54039b450c3f9eaaf8cc28bfba9c.exe

C:\Users\Admin\AppData\Local\Temp\02e7136ae3e0962597f69aa29c25231cc3fc54039b450c3f9eaaf8cc28bfba9c.exe
"C:\Users\Admin\AppData\Local\Temp\02e7136ae3e0962597f69aa29c25231cc3fc54039b450c3f9eaaf8cc28bfba9c.exe"
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 268
2⤵
- Program crash
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1888 -ip 1888
1⤵
PID:4748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-130-0x0000000000400000-0x00000000004437D8-memory.dmp

Filesize
269KB

Download
memory/1888-131-0x0000000000400000-0x00000000004437D8-memory.dmp

Filesize
269KB

Download