Overview

overview

10

Static

static

9

AuditApr2021.xlsx.exe

windows7_x64

10

AuditApr2021.xlsx.exe

windows10_x64

3

Analysis

  • max time kernel
    79s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    22-07-2021 15:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AuditApr2021.xlsx.exe

  • Size

    457KB

  • MD5

    583ad904b51ce0851f9f2cb056a9a2e3

  • SHA1

    daa33b986624b2156b336392c4d5cc1ddd184e56

  • SHA256

    95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481

  • SHA512

    ec96716efc1fe8662df5d9f0defa0f9d831a794d96bf8b5ad6c663395dd97c4127dbb4c1e8f73185a001722ef7861bedefda598df91739fd0a43ee05940d8f9c

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\AuditApr2021.xlsx.exe
        "C:\Users\Admin\AppData\Local\Temp\AuditApr2021.xlsx.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:676
      • C:\Users\Admin\AppData\Local\Temp\AuditApr2021.xlsx.exe
        C:\Users\Admin\AppData\Local\Temp\AuditApr2021.xlsx.exe 1
        2⤵
          PID:1196

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/676-59-0x0000000140000000-0x0000000140069000-memory.dmp
        Filesize

        420KB

        Download
      • memory/676-66-0x0000000000330000-0x0000000000395000-memory.dmp
        Filesize

        404KB

        Download
      • memory/1196-65-0x0000000000000000-mapping.dmp
        Download
      • memory/1196-73-0x0000000076A90000-0x0000000076BAF000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/1196-74-0x000007FEFE890000-0x000007FEFE96B000-memory.dmp
        Filesize

        876KB

        Download
      • memory/1196-75-0x000007FEFC110000-0x000007FEFC16B000-memory.dmp
        Filesize

        364KB

        Download
      • memory/1196-76-0x000007FEFDED0000-0x000007FEFE110000-memory.dmp
        Filesize

        2.2MB

        Download
      • memory/1196-77-0x000007FEFEF70000-0x000007FEFEFBD000-memory.dmp
        Filesize

        308KB

        Download
      • memory/1196-78-0x000007FEFA4B0000-0x000007FEFA4D7000-memory.dmp
        Filesize

        156KB

        Download
      • memory/1196-79-0x000007FEFCE00000-0x000007FEFCE6C000-memory.dmp
        Filesize

        432KB

        Download
      • memory/1196-80-0x00000000020E0000-0x0000000002120000-memory.dmp
        Filesize

        256KB

        Download
      • memory/1196-81-0x0000000002580000-0x0000000002605000-memory.dmp
        Filesize

        532KB

        Download