cobaltstrike | c6bd354e37e1859fab140177e930ab7a2c2f3797e749b03631b76722c89627c8

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 17:59

Target

6bc99c9259b0ca643f1b50bba8b89fe1_JaffaCakes118.dll
Size

268KB
MD5

6bc99c9259b0ca643f1b50bba8b89fe1
SHA1

a0c30bbddf4748169fb12a31a6bd6f1edbf65b61
SHA256

c6bd354e37e1859fab140177e930ab7a2c2f3797e749b03631b76722c89627c8
SHA512

c604ba302b5937eff65a23409285851dc667393f4900570fec622674285d76b5262f4797a64df98591cba89fa2d985aa1331137d60513ed960f446e23f493922
SSDEEP

3072:sZrNm0q1UmGTUVjsY9vsVfYLVthu1aYYp1V92R1n6/0IU1D5nq6B:sqV+KDCVfenh+Qfg2/0V5n

Score

10^/10

Family

cobaltstrike

Botnet

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1836 2008 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1836	2008	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2008	3068	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1836	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1836	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1836	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1836	2008	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc99c9259b0ca643f1b50bba8b89fe1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc99c9259b0ca643f1b50bba8b89fe1_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 192
3⤵
- Program crash
PID:1836

memory/2008-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download