Analysis

  • max time kernel
    82s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 23:30

General

  • Target

    fbbff9ab15b2fb7b5e2e5cfaf35810edd492df9448ca0d55a74b830724201543.exe

  • Size

    156KB

  • MD5

    467941e3cb0b3e1c379eb8ee10f57947

  • SHA1

    9a9a7a9bde0ca1f9f3cab121369d2473e817a03e

  • SHA256

    fbbff9ab15b2fb7b5e2e5cfaf35810edd492df9448ca0d55a74b830724201543

  • SHA512

    437cac30faf4dbbc98d72d804c11ef6289fb3145aefd91f393aa7a41579e1f5be2c87b3b43d142c140561d9af8ce1983ffa6979f84e56fae56d2a376c37efb24

  • SSDEEP

    3072:0s3yXdU7kClJgOEA6YbnVfyE1UirnmcOlq98VGScKtA1Jmtw3ff:0jeVEA6YhfRUq9SGScKsJV3

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbbff9ab15b2fb7b5e2e5cfaf35810edd492df9448ca0d55a74b830724201543.exe
    "C:\Users\Admin\AppData\Local\Temp\fbbff9ab15b2fb7b5e2e5cfaf35810edd492df9448ca0d55a74b830724201543.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Users\Admin\AppData\Roaming\WinHost\svchost.exe
        "C:\Users\Admin\AppData\Roaming\WinHost\svchost.exe"
        3⤵
        • Executes dropped EXE
        PID:428
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1220

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\WinHost\svchost.exe

      Filesize

      31KB

      MD5

      ed797d8dc2c92401985d162e42ffa450

      SHA1

      0f02fc517c7facc4baefde4fe9467fb6488ebabe

      SHA256

      b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

      SHA512

      e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

    • \Users\Admin\AppData\Roaming\WinHost\svchost.exe

      Filesize

      31KB

      MD5

      ed797d8dc2c92401985d162e42ffa450

      SHA1

      0f02fc517c7facc4baefde4fe9467fb6488ebabe

      SHA256

      b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

      SHA512

      e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

    • memory/1064-56-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-69-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-64-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-63-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-61-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-70-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-59-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1064-57-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1536-54-0x0000000076871000-0x0000000076873000-memory.dmp

      Filesize

      8KB

    • memory/1536-67-0x0000000074EE0000-0x000000007548B000-memory.dmp

      Filesize

      5.7MB

    • memory/1536-55-0x0000000074EE0000-0x000000007548B000-memory.dmp

      Filesize

      5.7MB