Analysis
- max time kernel
50s - max time network
25s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe
- Size 5.9MB
- Sample201110-rm45nldmke
- SHA256 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3
- MD5 738c1d6e222a3ce04419877828e5052f
- SHA1 a274e349097bac6482a46489a84d47fd4f32a9a8
- SHA512 b727eb3cec2349bb4df01ba8bf0615b73c17a5479ae7444765179546cf7e19f125e49f5176bfb2e65caadc1b71f82c52f28cd75ae04a23c1dcfb6388fce8d5e7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 15 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130dd-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130dd-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130de-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130de-5.dat cobalt_reflective_dll behavioral1/files/0x00050000000130e1-6.dat cobalt_reflective_dll behavioral1/files/0x00050000000130e1-8.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e2-9.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e2-11.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e3-12.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e3-14.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e4-15.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e4-17.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e5-18.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e5-20.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e6-21.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 7 IoCs
pid Process 1144 OAXAOcx.exe 2024 CwwqqCf.exe 1040 KaIXHRB.exe 1968 GXHleQg.exe 1980 sLzqTav.exe 1900 eeKSlYg.exe 1720 GjIbwkc.exe -
resource yara_rule behavioral1/files/0x00040000000130dd-0.dat upx behavioral1/files/0x00040000000130dd-2.dat upx behavioral1/files/0x00040000000130de-3.dat upx behavioral1/files/0x00040000000130de-5.dat upx behavioral1/files/0x00050000000130e1-6.dat upx behavioral1/files/0x00050000000130e1-8.dat upx behavioral1/files/0x00030000000130e2-9.dat upx behavioral1/files/0x00030000000130e2-11.dat upx behavioral1/files/0x00030000000130e3-12.dat upx behavioral1/files/0x00030000000130e3-14.dat upx behavioral1/files/0x00030000000130e4-15.dat upx behavioral1/files/0x00030000000130e4-17.dat upx behavioral1/files/0x00030000000130e5-18.dat upx behavioral1/files/0x00030000000130e5-20.dat upx behavioral1/files/0x00030000000130e6-21.dat upx - Loads dropped DLL 8 IoCs
pid Process 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe - JavaScript code in executable 15 IoCs
resource yara_rule behavioral1/files/0x00040000000130dd-0.dat js behavioral1/files/0x00040000000130dd-2.dat js behavioral1/files/0x00040000000130de-3.dat js behavioral1/files/0x00040000000130de-5.dat js behavioral1/files/0x00050000000130e1-6.dat js behavioral1/files/0x00050000000130e1-8.dat js behavioral1/files/0x00030000000130e2-9.dat js behavioral1/files/0x00030000000130e2-11.dat js behavioral1/files/0x00030000000130e3-12.dat js behavioral1/files/0x00030000000130e3-14.dat js behavioral1/files/0x00030000000130e4-15.dat js behavioral1/files/0x00030000000130e4-17.dat js behavioral1/files/0x00030000000130e5-18.dat js behavioral1/files/0x00030000000130e5-20.dat js behavioral1/files/0x00030000000130e6-21.dat js - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\System\KaIXHRB.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\GXHleQg.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\sLzqTav.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\eeKSlYg.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\GjIbwkc.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\qtGMXop.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\OAXAOcx.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe File created C:\Windows\System\CwwqqCf.exe 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 644 wrote to memory of 1144 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 27 PID 644 wrote to memory of 1144 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 27 PID 644 wrote to memory of 1144 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 27 PID 644 wrote to memory of 2024 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 28 PID 644 wrote to memory of 2024 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 28 PID 644 wrote to memory of 2024 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 28 PID 644 wrote to memory of 1040 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 29 PID 644 wrote to memory of 1040 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 29 PID 644 wrote to memory of 1040 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 29 PID 644 wrote to memory of 1968 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 30 PID 644 wrote to memory of 1968 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 30 PID 644 wrote to memory of 1968 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 30 PID 644 wrote to memory of 1980 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 31 PID 644 wrote to memory of 1980 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 31 PID 644 wrote to memory of 1980 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 31 PID 644 wrote to memory of 1900 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 32 PID 644 wrote to memory of 1900 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 32 PID 644 wrote to memory of 1900 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 32 PID 644 wrote to memory of 1720 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 33 PID 644 wrote to memory of 1720 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 33 PID 644 wrote to memory of 1720 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 33 PID 644 wrote to memory of 1804 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 34 PID 644 wrote to memory of 1804 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 34 PID 644 wrote to memory of 1804 644 21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe"C:\Users\Admin\AppData\Local\Temp\21929ea3fe1c387b95a490f35ee147c4634efdc72d46ff5d476dc32040f6eac3.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\System\OAXAOcx.exeC:\Windows\System\OAXAOcx.exe2⤵
- Executes dropped EXE
PID:1144
-
-
C:\Windows\System\CwwqqCf.exeC:\Windows\System\CwwqqCf.exe2⤵
- Executes dropped EXE
PID:2024
-
-
C:\Windows\System\KaIXHRB.exeC:\Windows\System\KaIXHRB.exe2⤵
- Executes dropped EXE
PID:1040
-
-
C:\Windows\System\GXHleQg.exeC:\Windows\System\GXHleQg.exe2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\System\sLzqTav.exeC:\Windows\System\sLzqTav.exe2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\System\eeKSlYg.exeC:\Windows\System\eeKSlYg.exe2⤵
- Executes dropped EXE
PID:1900
-
-
C:\Windows\System\GjIbwkc.exeC:\Windows\System\GjIbwkc.exe2⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\System\qtGMXop.exeC:\Windows\System\qtGMXop.exe2⤵PID:1804
-