Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-08-2021 20:01
Static task
static1
Behavioral task
behavioral1
Sample
cobaltocyanic.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
cobaltocyanic.exe
-
Size
3.9MB
-
MD5
26944aed6dfc2c25f96bbca49925fcaf
-
SHA1
b2b7a7a659abf7fd2c5596c119478363e0b7f360
-
SHA256
64dd547546394e1d431a25a671892c7aca9cf57ed0733a7435028792ad42f4a7
-
SHA512
ea0a599107acfbca4cc20987d003bd27a3168adea1df56378d4b6a934d1429d543bec91a7216c485ec0167b1d34ed510299e030944c4b8f6c3922b4699a4eabf
Malware Config
Extracted
Family
rustybuer
C2
https://awmelisers.com/
Signatures
-
Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: secinit.exe File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\o: secinit.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\i: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\q: secinit.exe File opened (read-only) \??\r: secinit.exe File opened (read-only) \??\s: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\w: secinit.exe File opened (read-only) \??\l: secinit.exe File opened (read-only) \??\n: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\D: secinit.exe File opened (read-only) \??\h: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\z: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\u: secinit.exe File opened (read-only) \??\v: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\g: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\f: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\p: secinit.exe File opened (read-only) \??\t: secinit.exe File opened (read-only) \??\x: secinit.exe File opened (read-only) \??\y: secinit.exe File opened (read-only) \??\Z: secinit.exe File opened (read-only) \??\a: secinit.exe File opened (read-only) \??\b: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\k: secinit.exe File opened (read-only) \??\m: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\e: secinit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1348 set thread context of 1216 1348 cobaltocyanic.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1216 secinit.exe 1216 secinit.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29 PID 1348 wrote to memory of 1216 1348 cobaltocyanic.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cobaltocyanic.exe"C:\Users\Admin\AppData\Local\Temp\cobaltocyanic.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\secinit.exe"C:\Windows\System32\secinit.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1216
-