Analysis
-
max time kernel
266s -
max time network
348s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 00:17
Behavioral task
behavioral1
Sample
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe
Resource
win10v2004-20221111-en
General
-
Target
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe
-
Size
307KB
-
MD5
7ca67f4affcd827c467dc432e556426b
-
SHA1
be9b41b4741a4eb679cd89b3094781f608d090ff
-
SHA256
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07
-
SHA512
17aab01c271be04637b7250f418fbd760a347fd459fdb10ca849ab1abe44845fd8dad0990dd7172338e10da0322100b8d46980159ab029c4212e4dee4ae5ea58
-
SSDEEP
6144:HkSzoT72Y0S+zinYKTY1SQshfRPVQe1MZkIYSccr7wbstOkPECYeixlYGicx:HkqE7SSpYsY1UMqMZJYSN7wbstOk8fvf
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 1 IoCs
Processes:
ywokfo.exepid process 864 ywokfo.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1404 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exepid process 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ywokfo.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\Currentversion\Run ywokfo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E8A35E48-3774-AD4D-52EE-D422474DF73F} = "C:\\Users\\Admin\\AppData\\Roaming\\Otru\\ywokfo.exe" ywokfo.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exedescription pid process target process PID 1156 set thread context of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe -
Processes:
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
ywokfo.exepid process 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe 864 ywokfo.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exeywokfo.exedescription pid process target process PID 1156 wrote to memory of 864 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe ywokfo.exe PID 1156 wrote to memory of 864 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe ywokfo.exe PID 1156 wrote to memory of 864 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe ywokfo.exe PID 1156 wrote to memory of 864 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe ywokfo.exe PID 864 wrote to memory of 1120 864 ywokfo.exe taskhost.exe PID 864 wrote to memory of 1120 864 ywokfo.exe taskhost.exe PID 864 wrote to memory of 1120 864 ywokfo.exe taskhost.exe PID 864 wrote to memory of 1120 864 ywokfo.exe taskhost.exe PID 864 wrote to memory of 1120 864 ywokfo.exe taskhost.exe PID 864 wrote to memory of 1172 864 ywokfo.exe Dwm.exe PID 864 wrote to memory of 1172 864 ywokfo.exe Dwm.exe PID 864 wrote to memory of 1172 864 ywokfo.exe Dwm.exe PID 864 wrote to memory of 1172 864 ywokfo.exe Dwm.exe PID 864 wrote to memory of 1172 864 ywokfo.exe Dwm.exe PID 864 wrote to memory of 1200 864 ywokfo.exe Explorer.EXE PID 864 wrote to memory of 1200 864 ywokfo.exe Explorer.EXE PID 864 wrote to memory of 1200 864 ywokfo.exe Explorer.EXE PID 864 wrote to memory of 1200 864 ywokfo.exe Explorer.EXE PID 864 wrote to memory of 1200 864 ywokfo.exe Explorer.EXE PID 864 wrote to memory of 1156 864 ywokfo.exe a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe PID 864 wrote to memory of 1156 864 ywokfo.exe a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe PID 864 wrote to memory of 1156 864 ywokfo.exe a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe PID 864 wrote to memory of 1156 864 ywokfo.exe a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe PID 864 wrote to memory of 1156 864 ywokfo.exe a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 1156 wrote to memory of 1404 1156 a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe cmd.exe PID 864 wrote to memory of 948 864 ywokfo.exe conhost.exe PID 864 wrote to memory of 948 864 ywokfo.exe conhost.exe PID 864 wrote to memory of 948 864 ywokfo.exe conhost.exe PID 864 wrote to memory of 948 864 ywokfo.exe conhost.exe PID 864 wrote to memory of 948 864 ywokfo.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe"C:\Users\Admin\AppData\Local\Temp\a08e6350ff827b1949ca14e7375ed610326f983da4aacb730db7c91ee7e35a07.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Otru\ywokfo.exe"C:\Users\Admin\AppData\Roaming\Otru\ywokfo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa6667b79.bat"2⤵
- Deletes itself
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1197745028144752550-234648853-2135675867-1899269697-511791271-349632908-891541334"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\syfeo.hinFilesize
466B
MD56c1e895175052b77157ad649fb212bda
SHA1cce3673667010729bd3060711e1381dd9b64b1d4
SHA2569c40bd76dd1f704b455c6072e1838e6f76c9e57d62be8b79c32a715c103f65e4
SHA512b45f86bf71952c203b860629e56df2ff8b8d95ce69a2928066129d5039f9a7a933d78b3bcb08b1768f6cfe7f45f45bdca3db3c693ee53213eb44668f06de9c4c
-
C:\Users\Admin\AppData\Local\Temp\tmpa6667b79.batFilesize
307B
MD5b6af1eba25b7fbd1df911aeb788baeb1
SHA1eac06fd00c2a04aeedff9b2dbb71988983ef59b2
SHA25693f947aac1c6ce309bec84b700c2569c89a03b6c858b42df2aede4c32a596874
SHA512b92df0810dc75e7412941b753264920c6c36b8242c162bf200de6b507e6a278588220438e4612d52a02bae1ea36382e360b785a0365d3cf9512d64c6771a9590
-
C:\Users\Admin\AppData\Roaming\Otru\ywokfo.exeFilesize
307KB
MD59a0f415f3c0b597d98b385013bff0937
SHA136bed11704e9e7e9d80a96ba2f3e414b061e82ae
SHA256e40681c8e52c3c130a6b7fd59f1b3eda8d259e52244ad91c063a1e70511f0973
SHA512f2d68aaa9ebf1893f24d044e86e457a482f7cf7812ea4d20038fe529534c6117b76215f29939a4f820fec89a9edc8d30efa3c90a553b8d587057e467d89cce41
-
C:\Users\Admin\AppData\Roaming\Otru\ywokfo.exeFilesize
307KB
MD59a0f415f3c0b597d98b385013bff0937
SHA136bed11704e9e7e9d80a96ba2f3e414b061e82ae
SHA256e40681c8e52c3c130a6b7fd59f1b3eda8d259e52244ad91c063a1e70511f0973
SHA512f2d68aaa9ebf1893f24d044e86e457a482f7cf7812ea4d20038fe529534c6117b76215f29939a4f820fec89a9edc8d30efa3c90a553b8d587057e467d89cce41
-
\Users\Admin\AppData\Roaming\Otru\ywokfo.exeFilesize
307KB
MD59a0f415f3c0b597d98b385013bff0937
SHA136bed11704e9e7e9d80a96ba2f3e414b061e82ae
SHA256e40681c8e52c3c130a6b7fd59f1b3eda8d259e52244ad91c063a1e70511f0973
SHA512f2d68aaa9ebf1893f24d044e86e457a482f7cf7812ea4d20038fe529534c6117b76215f29939a4f820fec89a9edc8d30efa3c90a553b8d587057e467d89cce41
-
memory/864-115-0x0000000000340000-0x0000000000391000-memory.dmpFilesize
324KB
-
memory/864-93-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/864-59-0x0000000000000000-mapping.dmp
-
memory/864-90-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/864-63-0x0000000000340000-0x0000000000391000-memory.dmpFilesize
324KB
-
memory/948-111-0x0000000001FA0000-0x0000000001FE4000-memory.dmpFilesize
272KB
-
memory/948-110-0x0000000001FA0000-0x0000000001FE4000-memory.dmpFilesize
272KB
-
memory/948-112-0x0000000001FA0000-0x0000000001FE4000-memory.dmpFilesize
272KB
-
memory/948-113-0x0000000001FA0000-0x0000000001FE4000-memory.dmpFilesize
272KB
-
memory/1120-66-0x0000000000420000-0x0000000000464000-memory.dmpFilesize
272KB
-
memory/1120-68-0x0000000000420000-0x0000000000464000-memory.dmpFilesize
272KB
-
memory/1120-69-0x0000000000420000-0x0000000000464000-memory.dmpFilesize
272KB
-
memory/1120-70-0x0000000000420000-0x0000000000464000-memory.dmpFilesize
272KB
-
memory/1120-71-0x0000000000420000-0x0000000000464000-memory.dmpFilesize
272KB
-
memory/1156-86-0x0000000000220000-0x0000000000264000-memory.dmpFilesize
272KB
-
memory/1156-92-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1156-62-0x0000000000220000-0x0000000000271000-memory.dmpFilesize
324KB
-
memory/1156-104-0x0000000000220000-0x0000000000264000-memory.dmpFilesize
272KB
-
memory/1156-61-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1156-54-0x00000000008B0000-0x0000000000901000-memory.dmpFilesize
324KB
-
memory/1156-88-0x0000000000220000-0x0000000000264000-memory.dmpFilesize
272KB
-
memory/1156-87-0x0000000000220000-0x0000000000264000-memory.dmpFilesize
272KB
-
memory/1156-89-0x0000000000220000-0x0000000000264000-memory.dmpFilesize
272KB
-
memory/1156-103-0x00000000008B0000-0x0000000000901000-memory.dmpFilesize
324KB
-
memory/1156-91-0x0000000000220000-0x0000000000271000-memory.dmpFilesize
324KB
-
memory/1156-57-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1156-56-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1156-94-0x0000000000220000-0x0000000000271000-memory.dmpFilesize
324KB
-
memory/1156-55-0x0000000075671000-0x0000000075673000-memory.dmpFilesize
8KB
-
memory/1172-76-0x0000000001B40000-0x0000000001B84000-memory.dmpFilesize
272KB
-
memory/1172-74-0x0000000001B40000-0x0000000001B84000-memory.dmpFilesize
272KB
-
memory/1172-77-0x0000000001B40000-0x0000000001B84000-memory.dmpFilesize
272KB
-
memory/1172-75-0x0000000001B40000-0x0000000001B84000-memory.dmpFilesize
272KB
-
memory/1200-80-0x0000000002960000-0x00000000029A4000-memory.dmpFilesize
272KB
-
memory/1200-83-0x0000000002960000-0x00000000029A4000-memory.dmpFilesize
272KB
-
memory/1200-82-0x0000000002960000-0x00000000029A4000-memory.dmpFilesize
272KB
-
memory/1200-81-0x0000000002960000-0x00000000029A4000-memory.dmpFilesize
272KB
-
memory/1404-99-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1404-107-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1404-102-0x00000000000671E6-mapping.dmp
-
memory/1404-101-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1404-100-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1404-97-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB