cobaltstrike | 1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9

Analysis

max time kernel
101s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:06

Target

1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9.dll
Size

1.9MB
MD5

34ce16849cdb1cd10ea1f8d1525136d7
SHA1

99d88aa5b93c5ef46d3fd9f6be6ff6b4369a4916
SHA256

1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9
SHA512

c0b286ac4e40ff77efe7ec25c5bea2068557d2b5ec7b5ce7c965eaa1f7a82c31a6d7e1a46c7d151e47c502ba4b070d93e48b919783fb4bd8c5d1fd47934f4719
SSDEEP

24576:CeSshda+Vu5jUrpJlYWkoMBjkmdmS4jCfk0DlPW9ZpsAtWQ2Lq3oWbSt:Ce7d/4S9TYho+kMiWB0ZpspLWb

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4952 1836 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
4952	1836	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4920 wrote to memory of 1836	4920	regsvr32.exe	regsvr32.exe
PID 4920 wrote to memory of 1836	4920	regsvr32.exe	regsvr32.exe
PID 4920 wrote to memory of 1836	4920	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9.dll
2⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 676
3⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1836 -ip 1836
1⤵
PID:5008

memory/1836-132-0x0000000000000000-mapping.dmp

Download
memory/1836-133-0x0000000002300000-0x0000000002361000-memory.dmp

Filesize
388KB

Download
memory/1836-134-0x00000000023B0000-0x00000000023E7000-memory.dmp

Filesize
220KB

Download