Analysis
- max time kernel
45s - max time network
14s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe
- Size 5.9MB
- Sample201110-e65jv51n2e
- SHA256 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f
- MD5 969f414ca8dd13e4e1c40107289abde5
- SHA1 020534148d3b82c75bc1c976205666aa6e91d502
- SHA512 56a41215453ed1e9303eb34fa1bf33bf4f45d840af6e7b5a1f1a68b776070485116df317b80b279e8ed7b49c0d93287361c3e44569a6b855485e692043fdf113
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 19 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x0004000000013107-0.dat cobalt_reflective_dll behavioral1/files/0x0004000000013107-2.dat cobalt_reflective_dll behavioral1/files/0x0004000000013108-3.dat cobalt_reflective_dll behavioral1/files/0x0004000000013108-5.dat cobalt_reflective_dll behavioral1/files/0x000500000001310b-8.dat cobalt_reflective_dll behavioral1/files/0x000500000001310b-6.dat cobalt_reflective_dll behavioral1/files/0x000300000001310c-9.dat cobalt_reflective_dll behavioral1/files/0x000300000001310c-11.dat cobalt_reflective_dll behavioral1/files/0x000300000001310d-12.dat cobalt_reflective_dll behavioral1/files/0x000300000001310d-14.dat cobalt_reflective_dll behavioral1/files/0x0003000000013115-17.dat cobalt_reflective_dll behavioral1/files/0x000300000001310f-19.dat cobalt_reflective_dll behavioral1/files/0x000300000001310f-15.dat cobalt_reflective_dll behavioral1/files/0x0003000000013115-20.dat cobalt_reflective_dll behavioral1/files/0x0003000000013117-21.dat cobalt_reflective_dll behavioral1/files/0x0003000000013117-23.dat cobalt_reflective_dll behavioral1/files/0x0003000000013129-24.dat cobalt_reflective_dll behavioral1/files/0x0003000000013129-26.dat cobalt_reflective_dll behavioral1/files/0x000300000001312b-27.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 9 IoCs
pid Process 1224 FBYtnHM.exe 1244 WNEEHIr.exe 1156 zGLvfWp.exe 1972 PXrdcwx.exe 1968 JmBHMZs.exe 1380 gmPOLTj.exe 1728 wVahzaw.exe 1844 tkExcvu.exe 1704 LQuFddN.exe -
resource yara_rule behavioral1/files/0x0004000000013107-0.dat upx behavioral1/files/0x0004000000013107-2.dat upx behavioral1/files/0x0004000000013108-3.dat upx behavioral1/files/0x0004000000013108-5.dat upx behavioral1/files/0x000500000001310b-8.dat upx behavioral1/files/0x000500000001310b-6.dat upx behavioral1/files/0x000300000001310c-9.dat upx behavioral1/files/0x000300000001310c-11.dat upx behavioral1/files/0x000300000001310d-12.dat upx behavioral1/files/0x000300000001310d-14.dat upx behavioral1/files/0x0003000000013115-17.dat upx behavioral1/files/0x000300000001310f-19.dat upx behavioral1/files/0x000300000001310f-15.dat upx behavioral1/files/0x0003000000013115-20.dat upx behavioral1/files/0x0003000000013117-21.dat upx behavioral1/files/0x0003000000013117-23.dat upx behavioral1/files/0x0003000000013129-24.dat upx behavioral1/files/0x0003000000013129-26.dat upx behavioral1/files/0x000300000001312b-27.dat upx - Loads dropped DLL 10 IoCs
pid Process 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe - JavaScript code in executable 19 IoCs
resource yara_rule behavioral1/files/0x0004000000013107-0.dat js behavioral1/files/0x0004000000013107-2.dat js behavioral1/files/0x0004000000013108-3.dat js behavioral1/files/0x0004000000013108-5.dat js behavioral1/files/0x000500000001310b-8.dat js behavioral1/files/0x000500000001310b-6.dat js behavioral1/files/0x000300000001310c-9.dat js behavioral1/files/0x000300000001310c-11.dat js behavioral1/files/0x000300000001310d-12.dat js behavioral1/files/0x000300000001310d-14.dat js behavioral1/files/0x0003000000013115-17.dat js behavioral1/files/0x000300000001310f-19.dat js behavioral1/files/0x000300000001310f-15.dat js behavioral1/files/0x0003000000013115-20.dat js behavioral1/files/0x0003000000013117-21.dat js behavioral1/files/0x0003000000013117-23.dat js behavioral1/files/0x0003000000013129-24.dat js behavioral1/files/0x0003000000013129-26.dat js behavioral1/files/0x000300000001312b-27.dat js - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\System\WNEEHIr.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\PXrdcwx.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\JmBHMZs.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\gmPOLTj.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\tkExcvu.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\VlVTPtY.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\FBYtnHM.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\zGLvfWp.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\wVahzaw.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe File created C:\Windows\System\LQuFddN.exe d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1084 wrote to memory of 1224 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 27 PID 1084 wrote to memory of 1224 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 27 PID 1084 wrote to memory of 1224 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 27 PID 1084 wrote to memory of 1244 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 28 PID 1084 wrote to memory of 1244 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 28 PID 1084 wrote to memory of 1244 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 28 PID 1084 wrote to memory of 1156 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 29 PID 1084 wrote to memory of 1156 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 29 PID 1084 wrote to memory of 1156 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 29 PID 1084 wrote to memory of 1972 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 30 PID 1084 wrote to memory of 1972 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 30 PID 1084 wrote to memory of 1972 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 30 PID 1084 wrote to memory of 1968 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 31 PID 1084 wrote to memory of 1968 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 31 PID 1084 wrote to memory of 1968 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 31 PID 1084 wrote to memory of 1380 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 32 PID 1084 wrote to memory of 1380 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 32 PID 1084 wrote to memory of 1380 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 32 PID 1084 wrote to memory of 1728 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 33 PID 1084 wrote to memory of 1728 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 33 PID 1084 wrote to memory of 1728 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 33 PID 1084 wrote to memory of 1844 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 34 PID 1084 wrote to memory of 1844 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 34 PID 1084 wrote to memory of 1844 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 34 PID 1084 wrote to memory of 1704 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 35 PID 1084 wrote to memory of 1704 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 35 PID 1084 wrote to memory of 1704 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 35 PID 1084 wrote to memory of 1528 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 36 PID 1084 wrote to memory of 1528 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 36 PID 1084 wrote to memory of 1528 1084 d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe"C:\Users\Admin\AppData\Local\Temp\d8e449d6444954e48b99faa5564669da44d7d039fc9d8485cf480997b9fcdf3f.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\System\FBYtnHM.exeC:\Windows\System\FBYtnHM.exe2⤵
- Executes dropped EXE
PID:1224
-
-
C:\Windows\System\WNEEHIr.exeC:\Windows\System\WNEEHIr.exe2⤵
- Executes dropped EXE
PID:1244
-
-
C:\Windows\System\zGLvfWp.exeC:\Windows\System\zGLvfWp.exe2⤵
- Executes dropped EXE
PID:1156
-
-
C:\Windows\System\PXrdcwx.exeC:\Windows\System\PXrdcwx.exe2⤵
- Executes dropped EXE
PID:1972
-
-
C:\Windows\System\JmBHMZs.exeC:\Windows\System\JmBHMZs.exe2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\System\gmPOLTj.exeC:\Windows\System\gmPOLTj.exe2⤵
- Executes dropped EXE
PID:1380
-
-
C:\Windows\System\wVahzaw.exeC:\Windows\System\wVahzaw.exe2⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\System\tkExcvu.exeC:\Windows\System\tkExcvu.exe2⤵
- Executes dropped EXE
PID:1844
-
-
C:\Windows\System\LQuFddN.exeC:\Windows\System\LQuFddN.exe2⤵
- Executes dropped EXE
PID:1704
-
-
C:\Windows\System\VlVTPtY.exeC:\Windows\System\VlVTPtY.exe2⤵PID:1528
-