cobaltstrike | 8029165ab2bfec99dccf3d05efe4fbb4f075c5bb8c2aad802cbf17b7a28edf5f

Analysis

max time kernel
141s
max time network
63s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
24-03-2023 12:21

Target

8029165ab2bfec99dccf3d05efe4fbb4f075c5bb8c2aad802cbf17b7a28edf5f.dll
Size

353KB
MD5

f6fea0789ae1a3c30ee0fd9fdf5d981c
SHA1

120c2e3fccc9b655e70d6356b380c80a068a5978
SHA256

8029165ab2bfec99dccf3d05efe4fbb4f075c5bb8c2aad802cbf17b7a28edf5f
SHA512

ff3ec503846bf2885f54d50ab32f8649e03050d8ea21128445219cdedcdb43c160fd9d131d3434104448ea021dd47428a1e15174edf3cc14e5b9252e145c25d0
SSDEEP

6144:T3qHCUAMukm5H0tT1Ee2k6SV4s68dTcEgDAIpiWe97TzGux0siC6pEOEGElVt9BP:TqiU9tmpfd+j

Score

10^/10

Family

cobaltstrike

http://bunedidu.com:443/components/common.gif

Attributes

user_agent
Host: google.fr Connection: close Accept-Language: en-GB;q=0.9, *;q=0.7 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4048 2488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4048	2488	WerFault.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8029165ab2bfec99dccf3d05efe4fbb4f075c5bb8c2aad802cbf17b7a28edf5f.dll,#1
1⤵
PID:2488

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2488 -s 964
2⤵
- Program crash
PID:4048

memory/2488-119-0x00000281C0E10000-0x00000281C0E11000-memory.dmp

Filesize
4KB

Download
memory/2488-118-0x00000281C0DF0000-0x00000281C0DF1000-memory.dmp

Filesize
4KB

Download
memory/2488-120-0x000000006AB00000-0x000000006AB4E000-memory.dmp

Filesize
312KB

Download