Analysis
- max time kernel
116s - max time network
121s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe
- Size 5.9MB
- Sample201110-2d791rd3pe
- SHA256 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f
- MD5 13141465cf078c03c028262048901037
- SHA1 59b15f1eec3f049cdebca831a64b9bd038772a59
- SHA512 750e5aa3875c7959df319193c44170ac4ad40829f2f0b721570b0c7c060500f6a012bc3012697c9affa94c81118814ba4427d9f247c0cae6a462d0b3a0aea61c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 25 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130c9-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130c9-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130ca-3.dat cobalt_reflective_dll behavioral1/files/0x00050000000130ce-5.dat cobalt_reflective_dll behavioral1/files/0x00040000000130ca-7.dat cobalt_reflective_dll behavioral1/files/0x00050000000130ce-8.dat cobalt_reflective_dll behavioral1/files/0x00030000000130cf-9.dat cobalt_reflective_dll behavioral1/files/0x00030000000130cf-11.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d0-12.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d0-14.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d1-15.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d1-17.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d2-18.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d2-20.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d3-23.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d3-21.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d4-24.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d4-26.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d5-27.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d5-29.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d6-32.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d6-30.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d7-33.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d7-35.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d8-36.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 12 IoCs
pid Process 2036 QhzuUzK.exe 1248 fEYTHrq.exe 1124 CTehkPg.exe 1376 UWAuilQ.exe 1212 mXHaTne.exe 1264 RujrmqD.exe 1896 OllvZrY.exe 1724 PKipmGV.exe 1792 zJjpflq.exe 1680 GVhXnpz.exe 1584 hmGhIqz.exe 1552 YlBMlJh.exe -
resource yara_rule behavioral1/files/0x00040000000130c9-0.dat upx behavioral1/files/0x00040000000130c9-2.dat upx behavioral1/files/0x00040000000130ca-3.dat upx behavioral1/files/0x00050000000130ce-5.dat upx behavioral1/files/0x00040000000130ca-7.dat upx behavioral1/files/0x00050000000130ce-8.dat upx behavioral1/files/0x00030000000130cf-9.dat upx behavioral1/files/0x00030000000130cf-11.dat upx behavioral1/files/0x00030000000130d0-12.dat upx behavioral1/files/0x00030000000130d0-14.dat upx behavioral1/files/0x00030000000130d1-15.dat upx behavioral1/files/0x00030000000130d1-17.dat upx behavioral1/files/0x00030000000130d2-18.dat upx behavioral1/files/0x00030000000130d2-20.dat upx behavioral1/files/0x00030000000130d3-23.dat upx behavioral1/files/0x00030000000130d3-21.dat upx behavioral1/files/0x00030000000130d4-24.dat upx behavioral1/files/0x00030000000130d4-26.dat upx behavioral1/files/0x00030000000130d5-27.dat upx behavioral1/files/0x00030000000130d5-29.dat upx behavioral1/files/0x00030000000130d6-32.dat upx behavioral1/files/0x00030000000130d6-30.dat upx behavioral1/files/0x00030000000130d7-33.dat upx behavioral1/files/0x00030000000130d7-35.dat upx behavioral1/files/0x00030000000130d8-36.dat upx - Loads dropped DLL 13 IoCs
pid Process 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe - JavaScript code in executable 25 IoCs
resource yara_rule behavioral1/files/0x00040000000130c9-0.dat js behavioral1/files/0x00040000000130c9-2.dat js behavioral1/files/0x00040000000130ca-3.dat js behavioral1/files/0x00050000000130ce-5.dat js behavioral1/files/0x00040000000130ca-7.dat js behavioral1/files/0x00050000000130ce-8.dat js behavioral1/files/0x00030000000130cf-9.dat js behavioral1/files/0x00030000000130cf-11.dat js behavioral1/files/0x00030000000130d0-12.dat js behavioral1/files/0x00030000000130d0-14.dat js behavioral1/files/0x00030000000130d1-15.dat js behavioral1/files/0x00030000000130d1-17.dat js behavioral1/files/0x00030000000130d2-18.dat js behavioral1/files/0x00030000000130d2-20.dat js behavioral1/files/0x00030000000130d3-23.dat js behavioral1/files/0x00030000000130d3-21.dat js behavioral1/files/0x00030000000130d4-24.dat js behavioral1/files/0x00030000000130d4-26.dat js behavioral1/files/0x00030000000130d5-27.dat js behavioral1/files/0x00030000000130d5-29.dat js behavioral1/files/0x00030000000130d6-32.dat js behavioral1/files/0x00030000000130d6-30.dat js behavioral1/files/0x00030000000130d7-33.dat js behavioral1/files/0x00030000000130d7-35.dat js behavioral1/files/0x00030000000130d8-36.dat js - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\System\QhzuUzK.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\fEYTHrq.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\CTehkPg.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\PKipmGV.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\hmGhIqz.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\YlBMlJh.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\JToHObl.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\UWAuilQ.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\mXHaTne.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\RujrmqD.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\OllvZrY.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\zJjpflq.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe File created C:\Windows\System\GVhXnpz.exe 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2036 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 27 PID 1080 wrote to memory of 2036 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 27 PID 1080 wrote to memory of 2036 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 27 PID 1080 wrote to memory of 1248 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 28 PID 1080 wrote to memory of 1248 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 28 PID 1080 wrote to memory of 1248 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 28 PID 1080 wrote to memory of 1124 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 29 PID 1080 wrote to memory of 1124 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 29 PID 1080 wrote to memory of 1124 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 29 PID 1080 wrote to memory of 1376 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 30 PID 1080 wrote to memory of 1376 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 30 PID 1080 wrote to memory of 1376 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 30 PID 1080 wrote to memory of 1212 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 31 PID 1080 wrote to memory of 1212 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 31 PID 1080 wrote to memory of 1212 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 31 PID 1080 wrote to memory of 1264 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 32 PID 1080 wrote to memory of 1264 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 32 PID 1080 wrote to memory of 1264 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 32 PID 1080 wrote to memory of 1896 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 33 PID 1080 wrote to memory of 1896 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 33 PID 1080 wrote to memory of 1896 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 33 PID 1080 wrote to memory of 1724 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 34 PID 1080 wrote to memory of 1724 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 34 PID 1080 wrote to memory of 1724 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 34 PID 1080 wrote to memory of 1792 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 35 PID 1080 wrote to memory of 1792 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 35 PID 1080 wrote to memory of 1792 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 35 PID 1080 wrote to memory of 1680 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 36 PID 1080 wrote to memory of 1680 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 36 PID 1080 wrote to memory of 1680 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 36 PID 1080 wrote to memory of 1584 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 37 PID 1080 wrote to memory of 1584 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 37 PID 1080 wrote to memory of 1584 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 37 PID 1080 wrote to memory of 1552 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 38 PID 1080 wrote to memory of 1552 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 38 PID 1080 wrote to memory of 1552 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 38 PID 1080 wrote to memory of 1224 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 39 PID 1080 wrote to memory of 1224 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 39 PID 1080 wrote to memory of 1224 1080 9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe"C:\Users\Admin\AppData\Local\Temp\9e8854739e00369dd4fadb44dd380f2bec17287502b9a8e0dcded27c33ea110f.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\System\QhzuUzK.exeC:\Windows\System\QhzuUzK.exe2⤵
- Executes dropped EXE
PID:2036
-
-
C:\Windows\System\fEYTHrq.exeC:\Windows\System\fEYTHrq.exe2⤵
- Executes dropped EXE
PID:1248
-
-
C:\Windows\System\CTehkPg.exeC:\Windows\System\CTehkPg.exe2⤵
- Executes dropped EXE
PID:1124
-
-
C:\Windows\System\UWAuilQ.exeC:\Windows\System\UWAuilQ.exe2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Windows\System\mXHaTne.exeC:\Windows\System\mXHaTne.exe2⤵
- Executes dropped EXE
PID:1212
-
-
C:\Windows\System\RujrmqD.exeC:\Windows\System\RujrmqD.exe2⤵
- Executes dropped EXE
PID:1264
-
-
C:\Windows\System\OllvZrY.exeC:\Windows\System\OllvZrY.exe2⤵
- Executes dropped EXE
PID:1896
-
-
C:\Windows\System\PKipmGV.exeC:\Windows\System\PKipmGV.exe2⤵
- Executes dropped EXE
PID:1724
-
-
C:\Windows\System\zJjpflq.exeC:\Windows\System\zJjpflq.exe2⤵
- Executes dropped EXE
PID:1792
-
-
C:\Windows\System\GVhXnpz.exeC:\Windows\System\GVhXnpz.exe2⤵
- Executes dropped EXE
PID:1680
-
-
C:\Windows\System\hmGhIqz.exeC:\Windows\System\hmGhIqz.exe2⤵
- Executes dropped EXE
PID:1584
-
-
C:\Windows\System\YlBMlJh.exeC:\Windows\System\YlBMlJh.exe2⤵
- Executes dropped EXE
PID:1552
-
-
C:\Windows\System\JToHObl.exeC:\Windows\System\JToHObl.exe2⤵PID:1224
-