Analysis

  • max time kernel
    580s
  • max time network
    580s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    03-02-2021 16:56

General

  • Target

    AnnualReport.exe

  • Size

    441KB

  • MD5

    2c00aaba1bad8a20cf1f154646e50878

  • SHA1

    314c5dd041216b0eb130075961ab660004e39fdf

  • SHA256

    52bbe09c7150ea66269c71bac8d0237fb0e6b0cae4ca63ab19807c310d6a1a0b

  • SHA512

    f6b48cb567a808b2b25b113a84476178ae42ffa7f4d47e03f6ca0c3e31762316f539d1913afedb88de28a6164c6551705130f28a66bdedfd4d182cf1cdd37ce0

Malware Config

Extracted

Family

cobaltstrike

Version

windows/download_exec

C2

http://topservicebin.com:443/wp-includes/eo.png

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 10 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnnualReport.exe
    "C:\Users\Admin\AppData\Local\Temp\AnnualReport.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      2⤵
      • Blocklisted process makes network request
      PID:4084
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4084 -s 936
        3⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1908-5-0x000001B5BA030000-0x000001B5BA031000-memory.dmp

    Filesize

    4KB

  • memory/4084-2-0x0000000000000000-mapping.dmp

  • memory/4084-3-0x000002BECA940000-0x000002BECA941000-memory.dmp

    Filesize

    4KB