Analysis
- max time kernel
79s - max time network
74s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe
- Size 5.2MB
- Sample201110-wafee4xe3x
- SHA256 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf
- MD5 715acb85d4b00010f63e2c06d42c2a57
- SHA1 ebea870b70ad9377cbc3b8671552803f00ccaa9c
- SHA512 88d074de2e7aa8e76bb3732c086e8400215093bfac7f991831c59a5e9cd396283710c6b761fec5d6d2bc7b0778d6772fdd967642c391511deb6ce685176ecfcd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 5 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130da-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130da-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130db-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130db-5.dat cobalt_reflective_dll behavioral1/files/0x00050000000130de-6.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 2 IoCs
pid Process 1768 KuRtLQw.exe 1928 RXaFSVw.exe -
resource yara_rule behavioral1/files/0x00040000000130da-0.dat upx behavioral1/files/0x00040000000130da-2.dat upx behavioral1/files/0x00040000000130db-3.dat upx behavioral1/files/0x00040000000130db-5.dat upx behavioral1/files/0x00050000000130de-6.dat upx - Loads dropped DLL 3 IoCs
pid Process 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe - JavaScript code in executable 5 IoCs
resource yara_rule behavioral1/files/0x00040000000130da-0.dat js behavioral1/files/0x00040000000130da-2.dat js behavioral1/files/0x00040000000130db-3.dat js behavioral1/files/0x00040000000130db-5.dat js behavioral1/files/0x00050000000130de-6.dat js - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\System\KuRtLQw.exe d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe File created C:\Windows\System\RXaFSVw.exe d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe File created C:\Windows\System\cMfWQms.exe d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1008 wrote to memory of 1768 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 27 PID 1008 wrote to memory of 1768 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 27 PID 1008 wrote to memory of 1768 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 27 PID 1008 wrote to memory of 1928 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 28 PID 1008 wrote to memory of 1928 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 28 PID 1008 wrote to memory of 1928 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 28 PID 1008 wrote to memory of 1980 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 29 PID 1008 wrote to memory of 1980 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 29 PID 1008 wrote to memory of 1980 1008 d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe"C:\Users\Admin\AppData\Local\Temp\d3137c02412d367b5dbffb3a72c0b2ccc0fe6c1a89dd630f18e4bec5349514cf.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\System\KuRtLQw.exeC:\Windows\System\KuRtLQw.exe2⤵
- Executes dropped EXE
PID:1768
-
-
C:\Windows\System\RXaFSVw.exeC:\Windows\System\RXaFSVw.exe2⤵
- Executes dropped EXE
PID:1928
-
-
C:\Windows\System\cMfWQms.exeC:\Windows\System\cMfWQms.exe2⤵PID:1980
-