Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 05:40
Behavioral task
behavioral1
Sample
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe
Resource
win10v2004-20221111-en
General
-
Target
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe
-
Size
307KB
-
MD5
7dffc7e2a8fc9d7240006bf7a98abde8
-
SHA1
0f77a9b9c4435d7a255cef7294832786d605da4a
-
SHA256
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf
-
SHA512
265fbdb016929b03a2f441717fde7ded7c42ffb65dfa69b59223b87c2d054812f405fb8c1757d055576040089ebebed638577692c842f7de4a9cdbd3f96f6e26
-
SSDEEP
6144:2qzwT72Y0SqzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOIPECYeixlYGic9i:2C87SSFYsY1UMqMZJYSN7wbstOI8fveT
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 1 IoCs
Processes:
tayq.exepid process 984 tayq.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1868 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exepid process 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
tayq.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\Currentversion\Run tayq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{CB118568-7F59-AD4D-CD9C-5E5DE9C17D40} = "C:\\Users\\Admin\\AppData\\Roaming\\Pugua\\tayq.exe" tayq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exedescription pid process target process PID 1292 set thread context of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe -
Processes:
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Privacy c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
tayq.exepid process 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe 984 tayq.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exetayq.exedescription pid process target process PID 1292 wrote to memory of 984 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe tayq.exe PID 1292 wrote to memory of 984 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe tayq.exe PID 1292 wrote to memory of 984 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe tayq.exe PID 1292 wrote to memory of 984 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe tayq.exe PID 984 wrote to memory of 1112 984 tayq.exe taskhost.exe PID 984 wrote to memory of 1112 984 tayq.exe taskhost.exe PID 984 wrote to memory of 1112 984 tayq.exe taskhost.exe PID 984 wrote to memory of 1112 984 tayq.exe taskhost.exe PID 984 wrote to memory of 1112 984 tayq.exe taskhost.exe PID 984 wrote to memory of 1176 984 tayq.exe Dwm.exe PID 984 wrote to memory of 1176 984 tayq.exe Dwm.exe PID 984 wrote to memory of 1176 984 tayq.exe Dwm.exe PID 984 wrote to memory of 1176 984 tayq.exe Dwm.exe PID 984 wrote to memory of 1176 984 tayq.exe Dwm.exe PID 984 wrote to memory of 1200 984 tayq.exe Explorer.EXE PID 984 wrote to memory of 1200 984 tayq.exe Explorer.EXE PID 984 wrote to memory of 1200 984 tayq.exe Explorer.EXE PID 984 wrote to memory of 1200 984 tayq.exe Explorer.EXE PID 984 wrote to memory of 1200 984 tayq.exe Explorer.EXE PID 984 wrote to memory of 1292 984 tayq.exe c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe PID 984 wrote to memory of 1292 984 tayq.exe c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe PID 984 wrote to memory of 1292 984 tayq.exe c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe PID 984 wrote to memory of 1292 984 tayq.exe c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe PID 984 wrote to memory of 1292 984 tayq.exe c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe PID 1292 wrote to memory of 1868 1292 c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe"C:\Users\Admin\AppData\Local\Temp\c31026364ef46dfb5ace4f4a0ac73e8b9f874dc517e3d052f3155d497c96d9bf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Pugua\tayq.exe"C:\Users\Admin\AppData\Roaming\Pugua\tayq.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp73d4cce4.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp73d4cce4.batFilesize
307B
MD59e7789767a952d179cee81ea585a9e93
SHA1631e1ab2aed07c80e6040887da12c6038d4d2401
SHA25673803ef8d81db3a368e01a697b448de76530829379e8fba6f77ba0ebe1116c01
SHA512fcb26918d3675339fd1cfd1fe0c76d3c6839752272adb7701daa8fa946b2237b37fde97038ebcf13b340a295e9cb7d4a8d7d5823320b2a9cb486cc4fffb1af58
-
C:\Users\Admin\AppData\Roaming\Pugua\tayq.exeFilesize
307KB
MD51dd663158f509d698aaa366e4be2d2d2
SHA1e6c156214635818a23e11edace86fe57a7acb8a0
SHA2566c3cba03b91115e0e6b81cc084b170490ad8ada0337e847480c2455075f6c03d
SHA5127cbb7804e3ae126eacc72ff651c81829d94f8dc910b0c19312104e6d6840596fcdb9761076d3c76836803cfbdfb852e523a4a82c687f55065c8c70640f71816b
-
C:\Users\Admin\AppData\Roaming\Pugua\tayq.exeFilesize
307KB
MD51dd663158f509d698aaa366e4be2d2d2
SHA1e6c156214635818a23e11edace86fe57a7acb8a0
SHA2566c3cba03b91115e0e6b81cc084b170490ad8ada0337e847480c2455075f6c03d
SHA5127cbb7804e3ae126eacc72ff651c81829d94f8dc910b0c19312104e6d6840596fcdb9761076d3c76836803cfbdfb852e523a4a82c687f55065c8c70640f71816b
-
\Users\Admin\AppData\Roaming\Pugua\tayq.exeFilesize
307KB
MD51dd663158f509d698aaa366e4be2d2d2
SHA1e6c156214635818a23e11edace86fe57a7acb8a0
SHA2566c3cba03b91115e0e6b81cc084b170490ad8ada0337e847480c2455075f6c03d
SHA5127cbb7804e3ae126eacc72ff651c81829d94f8dc910b0c19312104e6d6840596fcdb9761076d3c76836803cfbdfb852e523a4a82c687f55065c8c70640f71816b
-
memory/984-63-0x0000000000C00000-0x0000000000C50000-memory.dmpFilesize
320KB
-
memory/984-106-0x0000000000C00000-0x0000000000C50000-memory.dmpFilesize
320KB
-
memory/984-105-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/984-104-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/984-59-0x0000000000000000-mapping.dmp
-
memory/1112-68-0x0000000001D30000-0x0000000001D74000-memory.dmpFilesize
272KB
-
memory/1112-66-0x0000000001D30000-0x0000000001D74000-memory.dmpFilesize
272KB
-
memory/1112-69-0x0000000001D30000-0x0000000001D74000-memory.dmpFilesize
272KB
-
memory/1112-70-0x0000000001D30000-0x0000000001D74000-memory.dmpFilesize
272KB
-
memory/1112-71-0x0000000001D30000-0x0000000001D74000-memory.dmpFilesize
272KB
-
memory/1176-77-0x0000000001C60000-0x0000000001CA4000-memory.dmpFilesize
272KB
-
memory/1176-76-0x0000000001C60000-0x0000000001CA4000-memory.dmpFilesize
272KB
-
memory/1176-74-0x0000000001C60000-0x0000000001CA4000-memory.dmpFilesize
272KB
-
memory/1176-75-0x0000000001C60000-0x0000000001CA4000-memory.dmpFilesize
272KB
-
memory/1200-80-0x0000000002AD0000-0x0000000002B14000-memory.dmpFilesize
272KB
-
memory/1200-83-0x0000000002AD0000-0x0000000002B14000-memory.dmpFilesize
272KB
-
memory/1200-81-0x0000000002AD0000-0x0000000002B14000-memory.dmpFilesize
272KB
-
memory/1200-82-0x0000000002AD0000-0x0000000002B14000-memory.dmpFilesize
272KB
-
memory/1292-99-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1292-61-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1292-87-0x00000000003D0000-0x0000000000414000-memory.dmpFilesize
272KB
-
memory/1292-88-0x00000000003D0000-0x0000000000414000-memory.dmpFilesize
272KB
-
memory/1292-86-0x00000000003D0000-0x0000000000414000-memory.dmpFilesize
272KB
-
memory/1292-54-0x0000000000170000-0x00000000001C0000-memory.dmpFilesize
320KB
-
memory/1292-55-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB
-
memory/1292-56-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1292-57-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1292-89-0x00000000003D0000-0x0000000000414000-memory.dmpFilesize
272KB
-
memory/1292-98-0x0000000000170000-0x00000000001C0000-memory.dmpFilesize
320KB
-
memory/1292-100-0x00000000003D0000-0x0000000000414000-memory.dmpFilesize
272KB
-
memory/1292-62-0x00000000003D0000-0x0000000000420000-memory.dmpFilesize
320KB
-
memory/1868-94-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1868-97-0x00000000000671E6-mapping.dmp
-
memory/1868-103-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1868-95-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1868-96-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1868-92-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB