Analysis
- max time kernel
43s - max time network
9s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe
- Size 5.2MB
- Sample201110-yrh7celgmn
- SHA256 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8
- MD5 a4964bbfeafa37db2098646f4f14942a
- SHA1 3bbf4e4adf9075156969de857873165f95280d4a
- SHA512 82f96cdeab66f7ed55bf58143ea17c981243ab56d424cc79e98dcec8338636ac12983b7d7f17780b178cc8d79cb35ed52a83355f0dcccdd72bf3228588b7dfc4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 5 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130d1-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130d1-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130d2-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130d2-5.dat cobalt_reflective_dll behavioral1/files/0x00050000000130d5-6.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 2 IoCs
pid Process 1528 VHEgGka.exe 1976 YDLZUqW.exe -
resource yara_rule behavioral1/files/0x00040000000130d1-0.dat upx behavioral1/files/0x00040000000130d1-2.dat upx behavioral1/files/0x00040000000130d2-3.dat upx behavioral1/files/0x00040000000130d2-5.dat upx behavioral1/files/0x00050000000130d5-6.dat upx - Loads dropped DLL 3 IoCs
pid Process 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe - JavaScript code in executable 5 IoCs
resource yara_rule behavioral1/files/0x00040000000130d1-0.dat js behavioral1/files/0x00040000000130d1-2.dat js behavioral1/files/0x00040000000130d2-3.dat js behavioral1/files/0x00040000000130d2-5.dat js behavioral1/files/0x00050000000130d5-6.dat js - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\System\VHEgGka.exe 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe File created C:\Windows\System\YDLZUqW.exe 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe File created C:\Windows\System\AMcduhX.exe 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 784 wrote to memory of 1528 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 27 PID 784 wrote to memory of 1528 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 27 PID 784 wrote to memory of 1528 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 27 PID 784 wrote to memory of 1976 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 28 PID 784 wrote to memory of 1976 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 28 PID 784 wrote to memory of 1976 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 28 PID 784 wrote to memory of 1440 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 29 PID 784 wrote to memory of 1440 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 29 PID 784 wrote to memory of 1440 784 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe"C:\Users\Admin\AppData\Local\Temp\7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\System\VHEgGka.exeC:\Windows\System\VHEgGka.exe2⤵
- Executes dropped EXE
PID:1528
-
-
C:\Windows\System\YDLZUqW.exeC:\Windows\System\YDLZUqW.exe2⤵
- Executes dropped EXE
PID:1976
-
-
C:\Windows\System\AMcduhX.exeC:\Windows\System\AMcduhX.exe2⤵PID:1440
-