Analysis
- max time kernel
115s - max time network
14s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe
- Size 5.9MB
- Sample201110-lqd1emns2a
- SHA256 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20
- MD5 4f318f04e42eae7430de3dbf27fe925d
- SHA1 d771860ba4ffa2c6f4ab39acf61213f697dac7c2
- SHA512 74219661fe9db9da9c3e2c0262d067e3cd130864fac38ebb198ba3cf6e52d2bd21495fcfff92241b8ad62bd4839940e489a757c57b502f76f6daba6b96f70c06
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 15 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130cf-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130cf-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130d0-3.dat cobalt_reflective_dll behavioral1/files/0x00050000000130d3-6.dat cobalt_reflective_dll behavioral1/files/0x00040000000130d0-5.dat cobalt_reflective_dll behavioral1/files/0x00050000000130d3-8.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d4-9.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d4-11.dat cobalt_reflective_dll behavioral1/files/0x001900000000f55b-12.dat cobalt_reflective_dll behavioral1/files/0x001900000000f55b-14.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d6-15.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d6-17.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d7-18.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d7-20.dat cobalt_reflective_dll behavioral1/files/0x00030000000130d8-21.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 7 IoCs
pid Process 1424 NQsFgAA.exe 1564 yzMQQJn.exe 1984 DoUvGnC.exe 1968 VpXMsdu.exe 1956 LDwRPez.exe 1632 BAgASEl.exe 920 ioftWMK.exe -
resource yara_rule behavioral1/files/0x00040000000130cf-0.dat upx behavioral1/files/0x00040000000130cf-2.dat upx behavioral1/files/0x00040000000130d0-3.dat upx behavioral1/files/0x00050000000130d3-6.dat upx behavioral1/files/0x00040000000130d0-5.dat upx behavioral1/files/0x00050000000130d3-8.dat upx behavioral1/files/0x00030000000130d4-9.dat upx behavioral1/files/0x00030000000130d4-11.dat upx behavioral1/files/0x001900000000f55b-12.dat upx behavioral1/files/0x001900000000f55b-14.dat upx behavioral1/files/0x00030000000130d6-15.dat upx behavioral1/files/0x00030000000130d6-17.dat upx behavioral1/files/0x00030000000130d7-18.dat upx behavioral1/files/0x00030000000130d7-20.dat upx behavioral1/files/0x00030000000130d8-21.dat upx - Loads dropped DLL 8 IoCs
pid Process 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe - JavaScript code in executable 15 IoCs
resource yara_rule behavioral1/files/0x00040000000130cf-0.dat js behavioral1/files/0x00040000000130cf-2.dat js behavioral1/files/0x00040000000130d0-3.dat js behavioral1/files/0x00050000000130d3-6.dat js behavioral1/files/0x00040000000130d0-5.dat js behavioral1/files/0x00050000000130d3-8.dat js behavioral1/files/0x00030000000130d4-9.dat js behavioral1/files/0x00030000000130d4-11.dat js behavioral1/files/0x001900000000f55b-12.dat js behavioral1/files/0x001900000000f55b-14.dat js behavioral1/files/0x00030000000130d6-15.dat js behavioral1/files/0x00030000000130d6-17.dat js behavioral1/files/0x00030000000130d7-18.dat js behavioral1/files/0x00030000000130d7-20.dat js behavioral1/files/0x00030000000130d8-21.dat js - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\System\BAgASEl.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\ioftWMK.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\EJDKcMc.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\NQsFgAA.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\yzMQQJn.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\DoUvGnC.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\VpXMsdu.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe File created C:\Windows\System\LDwRPez.exe 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1424 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 27 PID 1924 wrote to memory of 1424 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 27 PID 1924 wrote to memory of 1424 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 27 PID 1924 wrote to memory of 1564 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 28 PID 1924 wrote to memory of 1564 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 28 PID 1924 wrote to memory of 1564 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 28 PID 1924 wrote to memory of 1984 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 29 PID 1924 wrote to memory of 1984 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 29 PID 1924 wrote to memory of 1984 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 29 PID 1924 wrote to memory of 1968 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 30 PID 1924 wrote to memory of 1968 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 30 PID 1924 wrote to memory of 1968 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 30 PID 1924 wrote to memory of 1956 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 34 PID 1924 wrote to memory of 1956 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 34 PID 1924 wrote to memory of 1956 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 34 PID 1924 wrote to memory of 1632 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 35 PID 1924 wrote to memory of 1632 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 35 PID 1924 wrote to memory of 1632 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 35 PID 1924 wrote to memory of 920 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 36 PID 1924 wrote to memory of 920 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 36 PID 1924 wrote to memory of 920 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 36 PID 1924 wrote to memory of 360 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 37 PID 1924 wrote to memory of 360 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 37 PID 1924 wrote to memory of 360 1924 241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe"C:\Users\Admin\AppData\Local\Temp\241ef6bcf617456f45f2a71f8a648b118b1c833f4f126f540081f7e446b4dc20.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System\NQsFgAA.exeC:\Windows\System\NQsFgAA.exe2⤵
- Executes dropped EXE
PID:1424
-
-
C:\Windows\System\yzMQQJn.exeC:\Windows\System\yzMQQJn.exe2⤵
- Executes dropped EXE
PID:1564
-
-
C:\Windows\System\DoUvGnC.exeC:\Windows\System\DoUvGnC.exe2⤵
- Executes dropped EXE
PID:1984
-
-
C:\Windows\System\VpXMsdu.exeC:\Windows\System\VpXMsdu.exe2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\System\LDwRPez.exeC:\Windows\System\LDwRPez.exe2⤵
- Executes dropped EXE
PID:1956
-
-
C:\Windows\System\BAgASEl.exeC:\Windows\System\BAgASEl.exe2⤵
- Executes dropped EXE
PID:1632
-
-
C:\Windows\System\ioftWMK.exeC:\Windows\System\ioftWMK.exe2⤵
- Executes dropped EXE
PID:920
-
-
C:\Windows\System\EJDKcMc.exeC:\Windows\System\EJDKcMc.exe2⤵PID:360
-