cobaltstrike | 5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 19:30

Target

5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509.dll
Size

12KB
MD5

e409740ca973a2374a137b62622261f2
SHA1

fbd8b7950064d2424e42b5293c7658ce14eac713
SHA256

5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509
SHA512

17e916132794bbf465281b59e7ba39f5cdf663496cda37b90faeca2c2729fc28326f07d52b7bb0fc33f91cf0279821c542cbcac5347b2b0f8db3072943cf4b9b
SSDEEP

192:izTyH59ZEOGECXOh7nsrdnD1QW6jOMeS09iL03DyIjJRtdt:izTyH2PSsrt18jxlIWIPtn

Score

10^/10

Family

cobaltstrike

http://192.168.132.130:12345/3vhL

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1324 set thread context of 1212 1324 rundll32.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3100 1212 WerFault.exe rundll32.exe

description	pid	process	target process
PID 1324 set thread context of 1212	1324	rundll32.exe	rundll32.exe

pid	pid_target	process	target process
3100	1212	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 5044 wrote to memory of 1324	5044	rundll32.exe	rundll32.exe
PID 5044 wrote to memory of 1324	5044	rundll32.exe	rundll32.exe
PID 5044 wrote to memory of 1324	5044	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1212	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1212	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1212	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1212	1324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 544
4⤵
- Program crash
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1212 -ip 1212
1⤵
PID:4076

memory/1212-0-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download