Analysis
- max time kernel
44s - max time network
33s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe
- Size 5.9MB
- Sample201110-m1b277y4a2
- SHA256 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46
- MD5 c65f9c598ce2b8e7a5438fd97942f965
- SHA1 111477022e497dd051916cb778268ac3cd4b9c8e
- SHA512 8130573c4f3d3c8a9bd37ed315daeb04289971525de851550052e5b48df6be2d942f9d07a46aa1594da29a5e7690b9ca8592258fdc661352212a5a03185431f5
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 13 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130fd-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130fd-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130fe-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130fe-5.dat cobalt_reflective_dll behavioral1/files/0x0005000000013101-6.dat cobalt_reflective_dll behavioral1/files/0x0005000000013101-10.dat cobalt_reflective_dll behavioral1/files/0x0003000000013103-8.dat cobalt_reflective_dll behavioral1/files/0x0003000000013103-11.dat cobalt_reflective_dll behavioral1/files/0x0003000000013105-14.dat cobalt_reflective_dll behavioral1/files/0x0003000000013105-12.dat cobalt_reflective_dll behavioral1/files/0x0003000000013106-15.dat cobalt_reflective_dll behavioral1/files/0x0003000000013106-17.dat cobalt_reflective_dll behavioral1/files/0x0003000000013107-18.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 6 IoCs
pid Process 1264 ZXrOJcx.exe 1584 KmFFYfr.exe 1616 MRRQoxG.exe 1968 hvdDoyG.exe 1888 vWjWWns.exe 1712 gCvfNzb.exe -
resource yara_rule behavioral1/files/0x00040000000130fd-0.dat upx behavioral1/files/0x00040000000130fd-2.dat upx behavioral1/files/0x00040000000130fe-3.dat upx behavioral1/files/0x00040000000130fe-5.dat upx behavioral1/files/0x0005000000013101-6.dat upx behavioral1/files/0x0005000000013101-10.dat upx behavioral1/files/0x0003000000013103-8.dat upx behavioral1/files/0x0003000000013103-11.dat upx behavioral1/files/0x0003000000013105-14.dat upx behavioral1/files/0x0003000000013105-12.dat upx behavioral1/files/0x0003000000013106-15.dat upx behavioral1/files/0x0003000000013106-17.dat upx behavioral1/files/0x0003000000013107-18.dat upx - Loads dropped DLL 7 IoCs
pid Process 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe - JavaScript code in executable 13 IoCs
resource yara_rule behavioral1/files/0x00040000000130fd-0.dat js behavioral1/files/0x00040000000130fd-2.dat js behavioral1/files/0x00040000000130fe-3.dat js behavioral1/files/0x00040000000130fe-5.dat js behavioral1/files/0x0005000000013101-6.dat js behavioral1/files/0x0005000000013101-10.dat js behavioral1/files/0x0003000000013103-8.dat js behavioral1/files/0x0003000000013103-11.dat js behavioral1/files/0x0003000000013105-14.dat js behavioral1/files/0x0003000000013105-12.dat js behavioral1/files/0x0003000000013106-15.dat js behavioral1/files/0x0003000000013106-17.dat js behavioral1/files/0x0003000000013107-18.dat js - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\System\vWjWWns.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe File created C:\Windows\System\gCvfNzb.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe File created C:\Windows\System\XdRXIxm.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe File created C:\Windows\System\ZXrOJcx.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe File created C:\Windows\System\KmFFYfr.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe File created C:\Windows\System\MRRQoxG.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe File created C:\Windows\System\hvdDoyG.exe 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1264 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 27 PID 1992 wrote to memory of 1264 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 27 PID 1992 wrote to memory of 1264 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 27 PID 1992 wrote to memory of 1584 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 28 PID 1992 wrote to memory of 1584 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 28 PID 1992 wrote to memory of 1584 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 28 PID 1992 wrote to memory of 1616 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 29 PID 1992 wrote to memory of 1616 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 29 PID 1992 wrote to memory of 1616 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 29 PID 1992 wrote to memory of 1968 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 30 PID 1992 wrote to memory of 1968 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 30 PID 1992 wrote to memory of 1968 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 30 PID 1992 wrote to memory of 1888 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 31 PID 1992 wrote to memory of 1888 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 31 PID 1992 wrote to memory of 1888 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 31 PID 1992 wrote to memory of 1712 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 32 PID 1992 wrote to memory of 1712 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 32 PID 1992 wrote to memory of 1712 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 32 PID 1992 wrote to memory of 1724 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 33 PID 1992 wrote to memory of 1724 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 33 PID 1992 wrote to memory of 1724 1992 9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe"C:\Users\Admin\AppData\Local\Temp\9efb439f8cfd33e2c97e5014abe4d1c9630c2144afb22de988b548c4035a4e46.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System\ZXrOJcx.exeC:\Windows\System\ZXrOJcx.exe2⤵
- Executes dropped EXE
PID:1264
-
-
C:\Windows\System\KmFFYfr.exeC:\Windows\System\KmFFYfr.exe2⤵
- Executes dropped EXE
PID:1584
-
-
C:\Windows\System\MRRQoxG.exeC:\Windows\System\MRRQoxG.exe2⤵
- Executes dropped EXE
PID:1616
-
-
C:\Windows\System\hvdDoyG.exeC:\Windows\System\hvdDoyG.exe2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\System\vWjWWns.exeC:\Windows\System\vWjWWns.exe2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\System\gCvfNzb.exeC:\Windows\System\gCvfNzb.exe2⤵
- Executes dropped EXE
PID:1712
-
-
C:\Windows\System\XdRXIxm.exeC:\Windows\System\XdRXIxm.exe2⤵PID:1724
-