Analysis
- max time kernel
79s - max time network
81s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe
- Size 5.9MB
- Sample201110-4pghw91fjs
- SHA256 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069
- MD5 f4d75463d7980e5205eb7e109f4689bb
- SHA1 580133a66bfa7cb904a7b28c994120b49ebb0720
- SHA512 d0b20df7a718222866d4a59805d0b2365c2d4292980cf0ad9f6757eb5436f7213628ad997b8880b0e90777bd8104294161a534e3f8784c9cf1726a48532c8080
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 25 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130e8-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130e8-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130e9-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130e9-5.dat cobalt_reflective_dll behavioral1/files/0x00050000000130ec-6.dat cobalt_reflective_dll behavioral1/files/0x00050000000130ec-8.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ed-9.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ed-11.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ee-12.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ee-14.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ef-15.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ef-17.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f0-18.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f0-20.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f1-21.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f1-23.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f2-24.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f2-26.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f3-27.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f3-29.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f4-30.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f4-32.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f5-33.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f5-35.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f6-36.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 12 IoCs
pid Process 2020 oooMgDi.exe 2044 RBXHmcB.exe 1308 jIfbMBO.exe 1300 IgKOQHw.exe 1988 jQwstUx.exe 1984 izOmMBW.exe 464 MjrZBiz.exe 1044 FboRcsY.exe 928 iviwBFf.exe 1948 lvXwwEF.exe 1712 YgpnLlR.exe 1744 rmaFviB.exe -
resource yara_rule behavioral1/files/0x00040000000130e8-0.dat upx behavioral1/files/0x00040000000130e8-2.dat upx behavioral1/files/0x00040000000130e9-3.dat upx behavioral1/files/0x00040000000130e9-5.dat upx behavioral1/files/0x00050000000130ec-6.dat upx behavioral1/files/0x00050000000130ec-8.dat upx behavioral1/files/0x00030000000130ed-9.dat upx behavioral1/files/0x00030000000130ed-11.dat upx behavioral1/files/0x00030000000130ee-12.dat upx behavioral1/files/0x00030000000130ee-14.dat upx behavioral1/files/0x00030000000130ef-15.dat upx behavioral1/files/0x00030000000130ef-17.dat upx behavioral1/files/0x00030000000130f0-18.dat upx behavioral1/files/0x00030000000130f0-20.dat upx behavioral1/files/0x00030000000130f1-21.dat upx behavioral1/files/0x00030000000130f1-23.dat upx behavioral1/files/0x00030000000130f2-24.dat upx behavioral1/files/0x00030000000130f2-26.dat upx behavioral1/files/0x00030000000130f3-27.dat upx behavioral1/files/0x00030000000130f3-29.dat upx behavioral1/files/0x00030000000130f4-30.dat upx behavioral1/files/0x00030000000130f4-32.dat upx behavioral1/files/0x00030000000130f5-33.dat upx behavioral1/files/0x00030000000130f5-35.dat upx behavioral1/files/0x00030000000130f6-36.dat upx - Loads dropped DLL 13 IoCs
pid Process 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe - JavaScript code in executable 25 IoCs
resource yara_rule behavioral1/files/0x00040000000130e8-0.dat js behavioral1/files/0x00040000000130e8-2.dat js behavioral1/files/0x00040000000130e9-3.dat js behavioral1/files/0x00040000000130e9-5.dat js behavioral1/files/0x00050000000130ec-6.dat js behavioral1/files/0x00050000000130ec-8.dat js behavioral1/files/0x00030000000130ed-9.dat js behavioral1/files/0x00030000000130ed-11.dat js behavioral1/files/0x00030000000130ee-12.dat js behavioral1/files/0x00030000000130ee-14.dat js behavioral1/files/0x00030000000130ef-15.dat js behavioral1/files/0x00030000000130ef-17.dat js behavioral1/files/0x00030000000130f0-18.dat js behavioral1/files/0x00030000000130f0-20.dat js behavioral1/files/0x00030000000130f1-21.dat js behavioral1/files/0x00030000000130f1-23.dat js behavioral1/files/0x00030000000130f2-24.dat js behavioral1/files/0x00030000000130f2-26.dat js behavioral1/files/0x00030000000130f3-27.dat js behavioral1/files/0x00030000000130f3-29.dat js behavioral1/files/0x00030000000130f4-30.dat js behavioral1/files/0x00030000000130f4-32.dat js behavioral1/files/0x00030000000130f5-33.dat js behavioral1/files/0x00030000000130f5-35.dat js behavioral1/files/0x00030000000130f6-36.dat js - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\System\RBXHmcB.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\FboRcsY.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\lvXwwEF.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\YgpnLlR.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\izOmMBW.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\MjrZBiz.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\iviwBFf.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\rmaFviB.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\oooMgDi.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\jIfbMBO.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\IgKOQHw.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\jQwstUx.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe File created C:\Windows\System\QJyDgYB.exe b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2020 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 27 PID 1632 wrote to memory of 2020 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 27 PID 1632 wrote to memory of 2020 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 27 PID 1632 wrote to memory of 2044 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 28 PID 1632 wrote to memory of 2044 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 28 PID 1632 wrote to memory of 2044 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 28 PID 1632 wrote to memory of 1308 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 29 PID 1632 wrote to memory of 1308 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 29 PID 1632 wrote to memory of 1308 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 29 PID 1632 wrote to memory of 1300 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 30 PID 1632 wrote to memory of 1300 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 30 PID 1632 wrote to memory of 1300 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 30 PID 1632 wrote to memory of 1988 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 31 PID 1632 wrote to memory of 1988 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 31 PID 1632 wrote to memory of 1988 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 31 PID 1632 wrote to memory of 1984 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 32 PID 1632 wrote to memory of 1984 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 32 PID 1632 wrote to memory of 1984 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 32 PID 1632 wrote to memory of 464 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 33 PID 1632 wrote to memory of 464 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 33 PID 1632 wrote to memory of 464 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 33 PID 1632 wrote to memory of 1044 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 34 PID 1632 wrote to memory of 1044 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 34 PID 1632 wrote to memory of 1044 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 34 PID 1632 wrote to memory of 928 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 35 PID 1632 wrote to memory of 928 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 35 PID 1632 wrote to memory of 928 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 35 PID 1632 wrote to memory of 1948 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 36 PID 1632 wrote to memory of 1948 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 36 PID 1632 wrote to memory of 1948 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 36 PID 1632 wrote to memory of 1712 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 37 PID 1632 wrote to memory of 1712 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 37 PID 1632 wrote to memory of 1712 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 37 PID 1632 wrote to memory of 1744 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 38 PID 1632 wrote to memory of 1744 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 38 PID 1632 wrote to memory of 1744 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 38 PID 1632 wrote to memory of 1164 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 39 PID 1632 wrote to memory of 1164 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 39 PID 1632 wrote to memory of 1164 1632 b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe"C:\Users\Admin\AppData\Local\Temp\b6ec8d5ce6ab9250e90cb1461726db4b830c6f2ddb613d207d8aa69f3b0e2069.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\System\oooMgDi.exeC:\Windows\System\oooMgDi.exe2⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\System\RBXHmcB.exeC:\Windows\System\RBXHmcB.exe2⤵
- Executes dropped EXE
PID:2044
-
-
C:\Windows\System\jIfbMBO.exeC:\Windows\System\jIfbMBO.exe2⤵
- Executes dropped EXE
PID:1308
-
-
C:\Windows\System\IgKOQHw.exeC:\Windows\System\IgKOQHw.exe2⤵
- Executes dropped EXE
PID:1300
-
-
C:\Windows\System\jQwstUx.exeC:\Windows\System\jQwstUx.exe2⤵
- Executes dropped EXE
PID:1988
-
-
C:\Windows\System\izOmMBW.exeC:\Windows\System\izOmMBW.exe2⤵
- Executes dropped EXE
PID:1984
-
-
C:\Windows\System\MjrZBiz.exeC:\Windows\System\MjrZBiz.exe2⤵
- Executes dropped EXE
PID:464
-
-
C:\Windows\System\FboRcsY.exeC:\Windows\System\FboRcsY.exe2⤵
- Executes dropped EXE
PID:1044
-
-
C:\Windows\System\iviwBFf.exeC:\Windows\System\iviwBFf.exe2⤵
- Executes dropped EXE
PID:928
-
-
C:\Windows\System\lvXwwEF.exeC:\Windows\System\lvXwwEF.exe2⤵
- Executes dropped EXE
PID:1948
-
-
C:\Windows\System\YgpnLlR.exeC:\Windows\System\YgpnLlR.exe2⤵
- Executes dropped EXE
PID:1712
-
-
C:\Windows\System\rmaFviB.exeC:\Windows\System\rmaFviB.exe2⤵
- Executes dropped EXE
PID:1744
-
-
C:\Windows\System\QJyDgYB.exeC:\Windows\System\QJyDgYB.exe2⤵PID:1164
-