cobaltstrike | c6bd354e37e1859fab140177e930ab7a2c2f3797e749b03631b76722c89627c8

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:59

Target

6bc99c9259b0ca643f1b50bba8b89fe1_JaffaCakes118.dll
Size

268KB
MD5

6bc99c9259b0ca643f1b50bba8b89fe1
SHA1

a0c30bbddf4748169fb12a31a6bd6f1edbf65b61
SHA256

c6bd354e37e1859fab140177e930ab7a2c2f3797e749b03631b76722c89627c8
SHA512

c604ba302b5937eff65a23409285851dc667393f4900570fec622674285d76b5262f4797a64df98591cba89fa2d985aa1331137d60513ed960f446e23f493922
SSDEEP

3072:sZrNm0q1UmGTUVjsY9vsVfYLVthu1aYYp1V92R1n6/0IU1D5nq6B:sqV+KDCVfenh+Qfg2/0V5n

Score

10^/10

Family

cobaltstrike

Botnet

Attributes

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5076 3164 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5076	3164	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 3164	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 3164	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 3164	2724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc99c9259b0ca643f1b50bba8b89fe1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc99c9259b0ca643f1b50bba8b89fe1_JaffaCakes118.dll,#1
2⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 564
3⤵
- Program crash
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:3620

memory/3164-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download