Analysis
- max time kernel
51s - max time network
20s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe
- Size 5.9MB
- Sample201110-e7y1qq3f7x
- SHA256 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba
- MD5 f710032cb05cd4e97e8cca8c80079a12
- SHA1 3b6e598efc5e7a294e3c8c4825c4a2099f4b5fd2
- SHA512 63a41533c52fc8cb62a861592feb102db04f8d0947553e56d90bf92e94fb5c1fb5c6e460f70d847ab740930762ddfb5c6819e0ae0e38d61551d4e7b3c16b03d7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 31 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130fe-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130fe-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130ff-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130ff-5.dat cobalt_reflective_dll behavioral1/files/0x0005000000013102-6.dat cobalt_reflective_dll behavioral1/files/0x0005000000013102-8.dat cobalt_reflective_dll behavioral1/files/0x0003000000013103-9.dat cobalt_reflective_dll behavioral1/files/0x0003000000013103-11.dat cobalt_reflective_dll behavioral1/files/0x0003000000013104-12.dat cobalt_reflective_dll behavioral1/files/0x0003000000013104-14.dat cobalt_reflective_dll behavioral1/files/0x0003000000013105-15.dat cobalt_reflective_dll behavioral1/files/0x0003000000013105-17.dat cobalt_reflective_dll behavioral1/files/0x0003000000013106-18.dat cobalt_reflective_dll behavioral1/files/0x0003000000013106-20.dat cobalt_reflective_dll behavioral1/files/0x0003000000013108-21.dat cobalt_reflective_dll behavioral1/files/0x0003000000013108-23.dat cobalt_reflective_dll behavioral1/files/0x000300000001310a-26.dat cobalt_reflective_dll behavioral1/files/0x000300000001310a-24.dat cobalt_reflective_dll behavioral1/files/0x000300000001310b-27.dat cobalt_reflective_dll behavioral1/files/0x000300000001310c-29.dat cobalt_reflective_dll behavioral1/files/0x000300000001310c-31.dat cobalt_reflective_dll behavioral1/files/0x000300000001310b-32.dat cobalt_reflective_dll behavioral1/files/0x000300000001310e-35.dat cobalt_reflective_dll behavioral1/files/0x000300000001310d-37.dat cobalt_reflective_dll behavioral1/files/0x000300000001310d-33.dat cobalt_reflective_dll behavioral1/files/0x000300000001310e-38.dat cobalt_reflective_dll behavioral1/files/0x000300000001310f-39.dat cobalt_reflective_dll behavioral1/files/0x000300000001310f-41.dat cobalt_reflective_dll behavioral1/files/0x0003000000013110-42.dat cobalt_reflective_dll behavioral1/files/0x0003000000013110-44.dat cobalt_reflective_dll behavioral1/files/0x0003000000013111-45.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 15 IoCs
pid Process 1888 OdORtSV.exe 1992 NllFsaV.exe 2016 RzGRYUr.exe 2036 YspSAit.exe 1968 aEDrjqB.exe 1940 OMcJhXW.exe 472 VkvCdfC.exe 900 RdKsMbC.exe 616 VeGUVJl.exe 1776 ODSxDRw.exe 1060 vnirztU.exe 1680 ZJsWqWM.exe 1232 AxjskGi.exe 1284 AfTjnMQ.exe 1452 LReriqO.exe -
resource yara_rule behavioral1/files/0x00040000000130fe-0.dat upx behavioral1/files/0x00040000000130fe-2.dat upx behavioral1/files/0x00040000000130ff-3.dat upx behavioral1/files/0x00040000000130ff-5.dat upx behavioral1/files/0x0005000000013102-6.dat upx behavioral1/files/0x0005000000013102-8.dat upx behavioral1/files/0x0003000000013103-9.dat upx behavioral1/files/0x0003000000013103-11.dat upx behavioral1/files/0x0003000000013104-12.dat upx behavioral1/files/0x0003000000013104-14.dat upx behavioral1/files/0x0003000000013105-15.dat upx behavioral1/files/0x0003000000013105-17.dat upx behavioral1/files/0x0003000000013106-18.dat upx behavioral1/files/0x0003000000013106-20.dat upx behavioral1/files/0x0003000000013108-21.dat upx behavioral1/files/0x0003000000013108-23.dat upx behavioral1/files/0x000300000001310a-26.dat upx behavioral1/files/0x000300000001310a-24.dat upx behavioral1/files/0x000300000001310b-27.dat upx behavioral1/files/0x000300000001310c-29.dat upx behavioral1/files/0x000300000001310c-31.dat upx behavioral1/files/0x000300000001310b-32.dat upx behavioral1/files/0x000300000001310e-35.dat upx behavioral1/files/0x000300000001310d-37.dat upx behavioral1/files/0x000300000001310d-33.dat upx behavioral1/files/0x000300000001310e-38.dat upx behavioral1/files/0x000300000001310f-39.dat upx behavioral1/files/0x000300000001310f-41.dat upx behavioral1/files/0x0003000000013110-42.dat upx behavioral1/files/0x0003000000013110-44.dat upx behavioral1/files/0x0003000000013111-45.dat upx - Loads dropped DLL 16 IoCs
pid Process 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe - JavaScript code in executable 31 IoCs
resource yara_rule behavioral1/files/0x00040000000130fe-0.dat js behavioral1/files/0x00040000000130fe-2.dat js behavioral1/files/0x00040000000130ff-3.dat js behavioral1/files/0x00040000000130ff-5.dat js behavioral1/files/0x0005000000013102-6.dat js behavioral1/files/0x0005000000013102-8.dat js behavioral1/files/0x0003000000013103-9.dat js behavioral1/files/0x0003000000013103-11.dat js behavioral1/files/0x0003000000013104-12.dat js behavioral1/files/0x0003000000013104-14.dat js behavioral1/files/0x0003000000013105-15.dat js behavioral1/files/0x0003000000013105-17.dat js behavioral1/files/0x0003000000013106-18.dat js behavioral1/files/0x0003000000013106-20.dat js behavioral1/files/0x0003000000013108-21.dat js behavioral1/files/0x0003000000013108-23.dat js behavioral1/files/0x000300000001310a-26.dat js behavioral1/files/0x000300000001310a-24.dat js behavioral1/files/0x000300000001310b-27.dat js behavioral1/files/0x000300000001310c-29.dat js behavioral1/files/0x000300000001310c-31.dat js behavioral1/files/0x000300000001310b-32.dat js behavioral1/files/0x000300000001310e-35.dat js behavioral1/files/0x000300000001310d-37.dat js behavioral1/files/0x000300000001310d-33.dat js behavioral1/files/0x000300000001310e-38.dat js behavioral1/files/0x000300000001310f-39.dat js behavioral1/files/0x000300000001310f-41.dat js behavioral1/files/0x0003000000013110-42.dat js behavioral1/files/0x0003000000013110-44.dat js behavioral1/files/0x0003000000013111-45.dat js - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\System\aEDrjqB.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\VkvCdfC.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\RdKsMbC.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\AxjskGi.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\NllFsaV.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\YspSAit.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\AfTjnMQ.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\LReriqO.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\RzGRYUr.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\ODSxDRw.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\OdORtSV.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\OMcJhXW.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\VeGUVJl.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\vnirztU.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\ZJsWqWM.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe File created C:\Windows\System\hZxBYuD.exe c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 748 wrote to memory of 1888 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 27 PID 748 wrote to memory of 1888 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 27 PID 748 wrote to memory of 1888 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 27 PID 748 wrote to memory of 1992 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 28 PID 748 wrote to memory of 1992 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 28 PID 748 wrote to memory of 1992 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 28 PID 748 wrote to memory of 2016 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 29 PID 748 wrote to memory of 2016 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 29 PID 748 wrote to memory of 2016 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 29 PID 748 wrote to memory of 2036 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 30 PID 748 wrote to memory of 2036 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 30 PID 748 wrote to memory of 2036 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 30 PID 748 wrote to memory of 1968 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 31 PID 748 wrote to memory of 1968 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 31 PID 748 wrote to memory of 1968 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 31 PID 748 wrote to memory of 1940 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 32 PID 748 wrote to memory of 1940 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 32 PID 748 wrote to memory of 1940 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 32 PID 748 wrote to memory of 472 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 33 PID 748 wrote to memory of 472 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 33 PID 748 wrote to memory of 472 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 33 PID 748 wrote to memory of 900 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 34 PID 748 wrote to memory of 900 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 34 PID 748 wrote to memory of 900 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 34 PID 748 wrote to memory of 616 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 35 PID 748 wrote to memory of 616 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 35 PID 748 wrote to memory of 616 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 35 PID 748 wrote to memory of 1060 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 36 PID 748 wrote to memory of 1060 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 36 PID 748 wrote to memory of 1060 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 36 PID 748 wrote to memory of 1776 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 37 PID 748 wrote to memory of 1776 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 37 PID 748 wrote to memory of 1776 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 37 PID 748 wrote to memory of 1680 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 38 PID 748 wrote to memory of 1680 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 38 PID 748 wrote to memory of 1680 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 38 PID 748 wrote to memory of 1232 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 39 PID 748 wrote to memory of 1232 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 39 PID 748 wrote to memory of 1232 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 39 PID 748 wrote to memory of 1284 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 40 PID 748 wrote to memory of 1284 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 40 PID 748 wrote to memory of 1284 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 40 PID 748 wrote to memory of 1452 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 42 PID 748 wrote to memory of 1452 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 42 PID 748 wrote to memory of 1452 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 42 PID 748 wrote to memory of 1468 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 43 PID 748 wrote to memory of 1468 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 43 PID 748 wrote to memory of 1468 748 c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe"C:\Users\Admin\AppData\Local\Temp\c2a008bf39c6bead44e4de0afe7e7f6809ec6d53a2a983671567775e7e74c1ba.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\System\OdORtSV.exeC:\Windows\System\OdORtSV.exe2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\System\NllFsaV.exeC:\Windows\System\NllFsaV.exe2⤵
- Executes dropped EXE
PID:1992
-
-
C:\Windows\System\RzGRYUr.exeC:\Windows\System\RzGRYUr.exe2⤵
- Executes dropped EXE
PID:2016
-
-
C:\Windows\System\YspSAit.exeC:\Windows\System\YspSAit.exe2⤵
- Executes dropped EXE
PID:2036
-
-
C:\Windows\System\aEDrjqB.exeC:\Windows\System\aEDrjqB.exe2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\System\OMcJhXW.exeC:\Windows\System\OMcJhXW.exe2⤵
- Executes dropped EXE
PID:1940
-
-
C:\Windows\System\VkvCdfC.exeC:\Windows\System\VkvCdfC.exe2⤵
- Executes dropped EXE
PID:472
-
-
C:\Windows\System\RdKsMbC.exeC:\Windows\System\RdKsMbC.exe2⤵
- Executes dropped EXE
PID:900
-
-
C:\Windows\System\VeGUVJl.exeC:\Windows\System\VeGUVJl.exe2⤵
- Executes dropped EXE
PID:616
-
-
C:\Windows\System\vnirztU.exeC:\Windows\System\vnirztU.exe2⤵
- Executes dropped EXE
PID:1060
-
-
C:\Windows\System\ODSxDRw.exeC:\Windows\System\ODSxDRw.exe2⤵
- Executes dropped EXE
PID:1776
-
-
C:\Windows\System\ZJsWqWM.exeC:\Windows\System\ZJsWqWM.exe2⤵
- Executes dropped EXE
PID:1680
-
-
C:\Windows\System\AxjskGi.exeC:\Windows\System\AxjskGi.exe2⤵
- Executes dropped EXE
PID:1232
-
-
C:\Windows\System\AfTjnMQ.exeC:\Windows\System\AfTjnMQ.exe2⤵
- Executes dropped EXE
PID:1284
-
-
C:\Windows\System\LReriqO.exeC:\Windows\System\LReriqO.exe2⤵
- Executes dropped EXE
PID:1452
-
-
C:\Windows\System\hZxBYuD.exeC:\Windows\System\hZxBYuD.exe2⤵PID:1468
-