Overview

overview

10

Static

static

10

eeecd2e7f3...b1.exe

windows7_x64

10

eeecd2e7f3...b1.exe

windows10_x64

1

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    10/11/2020, 07:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    eeecd2e7f3586adfc3ee78d67e6b8c84705ce3472ca52d266c0cef89883b36b1.exe
  • Size 5.9MB
  • Sample201110-s5vpqltnf2
  • SHA256 eeecd2e7f3586adfc3ee78d67e6b8c84705ce3472ca52d266c0cef89883b36b1
  • MD5 SHA1 SHA512
Score
10/10
cobaltstrikebackdoortrojanupx

Malware Config

Signatures

  • Cobalt Strike reflective loader 42 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Executes dropped EXE 21 IoCs
  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 21 IoCs
  • JavaScript code in executable 42 IoCs
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeecd2e7f3586adfc3ee78d67e6b8c84705ce3472ca52d266c0cef89883b36b1.exe
    "C:\Users\Admin\AppData\Local\Temp\eeecd2e7f3586adfc3ee78d67e6b8c84705ce3472ca52d266c0cef89883b36b1.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\System\ynGUMJK.exe
      C:\Windows\System\ynGUMJK.exe
      2⤵
      • Executes dropped EXE
      PID:1548
    • C:\Windows\System\YcgMARa.exe
      C:\Windows\System\YcgMARa.exe
      2⤵
      • Executes dropped EXE
      PID:1464
    • C:\Windows\System\MgCeLkF.exe
      C:\Windows\System\MgCeLkF.exe
      2⤵
      • Executes dropped EXE
      PID:1984
    • C:\Windows\System\uXKEhPn.exe
      C:\Windows\System\uXKEhPn.exe
      2⤵
      • Executes dropped EXE
      PID:1124
    • C:\Windows\System\udMQGJC.exe
      C:\Windows\System\udMQGJC.exe
      2⤵
      • Executes dropped EXE
      PID:1804
    • C:\Windows\System\tnbNrZZ.exe
      C:\Windows\System\tnbNrZZ.exe
      2⤵
      • Executes dropped EXE
      PID:1736
    • C:\Windows\System\qlKgjXe.exe
      C:\Windows\System\qlKgjXe.exe
      2⤵
      • Executes dropped EXE
      PID:1740
    • C:\Windows\System\yksqbnB.exe
      C:\Windows\System\yksqbnB.exe
      2⤵
      • Executes dropped EXE
      PID:1828
    • C:\Windows\System\kHEpuEN.exe
      C:\Windows\System\kHEpuEN.exe
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Windows\System\YOkEvgR.exe
      C:\Windows\System\YOkEvgR.exe
      2⤵
      • Executes dropped EXE
      PID:1756
    • C:\Windows\System\TSXaBuf.exe
      C:\Windows\System\TSXaBuf.exe
      2⤵
      • Executes dropped EXE
      PID:1700
    • C:\Windows\System\kjAnTQF.exe
      C:\Windows\System\kjAnTQF.exe
      2⤵
      • Executes dropped EXE
      PID:1096
    • C:\Windows\System\jaNaaFa.exe
      C:\Windows\System\jaNaaFa.exe
      2⤵
      • Executes dropped EXE
      PID:308
    • C:\Windows\System\tOZQNaQ.exe
      C:\Windows\System\tOZQNaQ.exe
      2⤵
      • Executes dropped EXE
      PID:596
    • C:\Windows\System\xerqUeg.exe
      C:\Windows\System\xerqUeg.exe
      2⤵
      • Executes dropped EXE
      PID:1924
    • C:\Windows\System\wikurWU.exe
      C:\Windows\System\wikurWU.exe
      2⤵
      • Executes dropped EXE
      PID:1928
    • C:\Windows\System\FhGwUcV.exe
      C:\Windows\System\FhGwUcV.exe
      2⤵
      • Executes dropped EXE
      PID:764
    • C:\Windows\System\JVtKGbb.exe
      C:\Windows\System\JVtKGbb.exe
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Windows\System\OmAKIuF.exe
      C:\Windows\System\OmAKIuF.exe
      2⤵
      • Executes dropped EXE
      PID:1060
    • C:\Windows\System\migCEfK.exe
      C:\Windows\System\migCEfK.exe
      2⤵
      • Executes dropped EXE
      PID:1484
    • C:\Windows\System\xatUKvK.exe
      C:\Windows\System\xatUKvK.exe
      2⤵
      • Executes dropped EXE
      PID:2020

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads