Overview

overview

10

Static

static

10

7591a1f8cb...c8.exe

windows7_x64

10

7591a1f8cb...c8.exe

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10/11/2020, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe
  • Size 5.2MB
  • Sample201110-yrh7celgmn
  • SHA256 7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8
  • MD5 SHA1 SHA512
Score
10/10
cobaltstrikebackdoortrojanupx

Malware Config

Signatures

  • Cobalt Strike reflective loader 42 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Executes dropped EXE 21 IoCs
  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • JavaScript code in executable 42 IoCs
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe
    "C:\Users\Admin\AppData\Local\Temp\7591a1f8cb3bb8bd8cce16eece47e9d29c980824a5895291e4146f37ba3eeac8.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\System\cxvqoYU.exe
      C:\Windows\System\cxvqoYU.exe
      2⤵
      • Executes dropped EXE
      PID:580
    • C:\Windows\System\vHrrwKH.exe
      C:\Windows\System\vHrrwKH.exe
      2⤵
      • Executes dropped EXE
      PID:1008
    • C:\Windows\System\rhJdprb.exe
      C:\Windows\System\rhJdprb.exe
      2⤵
      • Executes dropped EXE
      PID:1280
    • C:\Windows\System\DxzAaST.exe
      C:\Windows\System\DxzAaST.exe
      2⤵
      • Executes dropped EXE
      PID:1768
    • C:\Windows\System\HFMztkV.exe
      C:\Windows\System\HFMztkV.exe
      2⤵
      • Executes dropped EXE
      PID:1992
    • C:\Windows\System\EMUQhZo.exe
      C:\Windows\System\EMUQhZo.exe
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\System\pQmTMym.exe
      C:\Windows\System\pQmTMym.exe
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\System\GGSJpJY.exe
      C:\Windows\System\GGSJpJY.exe
      2⤵
      • Executes dropped EXE
      PID:3908
    • C:\Windows\System\nduSnTE.exe
      C:\Windows\System\nduSnTE.exe
      2⤵
      • Executes dropped EXE
      PID:2820
    • C:\Windows\System\RPlfYqy.exe
      C:\Windows\System\RPlfYqy.exe
      2⤵
      • Executes dropped EXE
      PID:2632
    • C:\Windows\System\ityPNmB.exe
      C:\Windows\System\ityPNmB.exe
      2⤵
      • Executes dropped EXE
      PID:3828
    • C:\Windows\System\yHZcbEF.exe
      C:\Windows\System\yHZcbEF.exe
      2⤵
      • Executes dropped EXE
      PID:208
    • C:\Windows\System\lzEQevg.exe
      C:\Windows\System\lzEQevg.exe
      2⤵
      • Executes dropped EXE
      PID:3312
    • C:\Windows\System\orJSmFY.exe
      C:\Windows\System\orJSmFY.exe
      2⤵
      • Executes dropped EXE
      PID:2716
    • C:\Windows\System\TOWLtnS.exe
      C:\Windows\System\TOWLtnS.exe
      2⤵
      • Executes dropped EXE
      PID:1328
    • C:\Windows\System\mGMVVXt.exe
      C:\Windows\System\mGMVVXt.exe
      2⤵
      • Executes dropped EXE
      PID:1892
    • C:\Windows\System\CXAxVQW.exe
      C:\Windows\System\CXAxVQW.exe
      2⤵
      • Executes dropped EXE
      PID:3132
    • C:\Windows\System\sZbsqSx.exe
      C:\Windows\System\sZbsqSx.exe
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\System\fXazduy.exe
      C:\Windows\System\fXazduy.exe
      2⤵
      • Executes dropped EXE
      PID:4076
    • C:\Windows\System\VJcTWDJ.exe
      C:\Windows\System\VJcTWDJ.exe
      2⤵
      • Executes dropped EXE
      PID:3836
    • C:\Windows\System\CLQgsYv.exe
      C:\Windows\System\CLQgsYv.exe
      2⤵
      • Executes dropped EXE
      PID:4032

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads