↓ Skip to main content
bubka hacks stuff

WinDBG

HTB-CrashDump

Malware Analysis Windows PE WinDBG Mini Dump Cobalt
Analyzed two process dumps (notepad.exe and update.exe) revealing a Cobalt Strike Beacon infection. The malware used process injection with reflective DLL loading, communicated with C2 server at 101.10.25.4:8023, and possessed capabilities for privilege escalation, token manipulation, and lateral movement via named pipes.