Analysis
-
max time kernel
293s -
max time network
296s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-01-2022 16:29
Static task
static1
Behavioral task
behavioral1
Sample
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe
Resource
win10-en-20211208
General
-
Target
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe
-
Size
115KB
-
MD5
a5bd0778a3baac35f9c40b06951b92be
-
SHA1
442182ec444bad81041875380b2968041b4d3096
-
SHA256
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2
-
SHA512
10e204c9b8439fc70f55206b5ed1a37708459535fe7b05a32d68dd215a65e20af17a96611665b583be0dc96ffc9e9cb44fc240f76a65fb8e30ea2226dfaf7b1c
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 1 IoCs
Processes:
CacheMgr.exepid process 1324 CacheMgr.exe -
Loads dropped DLL 1 IoCs
Processes:
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exepid process 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\CacheMgr.exe\" -as" 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exedescription pid process target process PID 1072 wrote to memory of 1884 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe cmd.exe PID 1072 wrote to memory of 1884 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe cmd.exe PID 1072 wrote to memory of 1884 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe cmd.exe PID 1072 wrote to memory of 1884 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe cmd.exe PID 1072 wrote to memory of 1324 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe CacheMgr.exe PID 1072 wrote to memory of 1324 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe CacheMgr.exe PID 1072 wrote to memory of 1324 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe CacheMgr.exe PID 1072 wrote to memory of 1324 1072 00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe CacheMgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe"C:\Users\Admin\AppData\Local\Temp\00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\00472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2.exe" "C:\Users\Admin\AppData\Roaming\CacheMgr.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\CacheMgr.exe"C:\Users\Admin\AppData\Roaming\CacheMgr.exe" -as2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\CacheMgr.exeMD5
a5bd0778a3baac35f9c40b06951b92be
SHA1442182ec444bad81041875380b2968041b4d3096
SHA25600472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2
SHA51210e204c9b8439fc70f55206b5ed1a37708459535fe7b05a32d68dd215a65e20af17a96611665b583be0dc96ffc9e9cb44fc240f76a65fb8e30ea2226dfaf7b1c
-
C:\Users\Admin\AppData\Roaming\CacheMgr.exeMD5
a5bd0778a3baac35f9c40b06951b92be
SHA1442182ec444bad81041875380b2968041b4d3096
SHA25600472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2
SHA51210e204c9b8439fc70f55206b5ed1a37708459535fe7b05a32d68dd215a65e20af17a96611665b583be0dc96ffc9e9cb44fc240f76a65fb8e30ea2226dfaf7b1c
-
\Users\Admin\AppData\Roaming\CacheMgr.exeMD5
a5bd0778a3baac35f9c40b06951b92be
SHA1442182ec444bad81041875380b2968041b4d3096
SHA25600472b5baa597592dd522408cc6cec01eaec526ef8d0b709a9a9e2c09f7a97c2
SHA51210e204c9b8439fc70f55206b5ed1a37708459535fe7b05a32d68dd215a65e20af17a96611665b583be0dc96ffc9e9cb44fc240f76a65fb8e30ea2226dfaf7b1c
-
memory/1072-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1072-53-0x00000000007A1000-0x00000000007B2000-memory.dmpFilesize
68KB
-
memory/1072-55-0x0000000000020000-0x0000000000035000-memory.dmpFilesize
84KB
-
memory/1324-59-0x0000000000000000-mapping.dmp
-
memory/1324-61-0x0000000000611000-0x0000000000622000-memory.dmpFilesize
68KB
-
memory/1884-56-0x0000000000000000-mapping.dmp