Analysis
-
max time kernel
187s -
max time network
188s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:06
Behavioral task
behavioral1
Sample
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe
Resource
win10v2004-20220812-en
General
-
Target
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe
-
Size
312KB
-
MD5
8994f0c6fb51940bca5dbbdaad6a8a2d
-
SHA1
5499b96409af5f619af42dc4e8daa7a6551bc240
-
SHA256
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b
-
SHA512
d6b161f9fd27a2283267a26032fbbdd813270462bd2cc86ecd8889e6d16a8c757a0efe9095fbf54aef08f7be4f2f47fd3d3878886574152c293ec8b3745b1b44
-
SSDEEP
6144:I+1VyBRl40pPUMHLdL1hALe+2NirdrQdZiwUKD0cE:IEy94wUMdoLT2NKcww8
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 1 IoCs
Processes:
zeehy.exepid process 468 zeehy.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 280 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exepid process 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
zeehy.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\Currentversion\Run zeehy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7B2FDFC8-3774-AD4D-C411-AE4FF0968D52} = "C:\\Users\\Admin\\AppData\\Roaming\\Jadaa\\zeehy.exe" zeehy.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exedescription pid process target process PID 1208 set thread context of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe -
Processes:
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Privacy be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
zeehy.exepid process 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe 468 zeehy.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exezeehy.exedescription pid process target process PID 1208 wrote to memory of 468 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe zeehy.exe PID 1208 wrote to memory of 468 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe zeehy.exe PID 1208 wrote to memory of 468 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe zeehy.exe PID 1208 wrote to memory of 468 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe zeehy.exe PID 468 wrote to memory of 1132 468 zeehy.exe taskhost.exe PID 468 wrote to memory of 1132 468 zeehy.exe taskhost.exe PID 468 wrote to memory of 1132 468 zeehy.exe taskhost.exe PID 468 wrote to memory of 1132 468 zeehy.exe taskhost.exe PID 468 wrote to memory of 1132 468 zeehy.exe taskhost.exe PID 468 wrote to memory of 1192 468 zeehy.exe Dwm.exe PID 468 wrote to memory of 1192 468 zeehy.exe Dwm.exe PID 468 wrote to memory of 1192 468 zeehy.exe Dwm.exe PID 468 wrote to memory of 1192 468 zeehy.exe Dwm.exe PID 468 wrote to memory of 1192 468 zeehy.exe Dwm.exe PID 468 wrote to memory of 1252 468 zeehy.exe Explorer.EXE PID 468 wrote to memory of 1252 468 zeehy.exe Explorer.EXE PID 468 wrote to memory of 1252 468 zeehy.exe Explorer.EXE PID 468 wrote to memory of 1252 468 zeehy.exe Explorer.EXE PID 468 wrote to memory of 1252 468 zeehy.exe Explorer.EXE PID 468 wrote to memory of 1208 468 zeehy.exe be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe PID 468 wrote to memory of 1208 468 zeehy.exe be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe PID 468 wrote to memory of 1208 468 zeehy.exe be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe PID 468 wrote to memory of 1208 468 zeehy.exe be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe PID 468 wrote to memory of 1208 468 zeehy.exe be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe PID 1208 wrote to memory of 280 1208 be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe"C:\Users\Admin\AppData\Local\Temp\be29edd1a9ec851cba0620b46a934211e96edc0d00008bb46b296d8dc8ea7d2b.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Jadaa\zeehy.exe"C:\Users\Admin\AppData\Roaming\Jadaa\zeehy.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb28038af.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpb28038af.batFilesize
307B
MD53ac44080d492a9edde2ab2c5f9190d8b
SHA121cb951e0c5a7c78b5d97e5ae2eb7ae9135fb7dc
SHA25666a0375e090050a7c4a2ca97880d62cd296742f4a20b54fc589df2385a90316e
SHA512e86974344df6eb3bee0b4b0e035a50c8472f6f1f89d4be38a34b78fa4517cf17ae4c14cac9d84a225059b27a3806e734ffee42e708483a5d0b6c616897a55847
-
C:\Users\Admin\AppData\Roaming\Jadaa\zeehy.exeFilesize
312KB
MD5cb55789a12e7c975ebad791571683774
SHA1986cf07ed4942569088dced3fdfb8154fe095d20
SHA256deaffa3fc053c2d85f8109e89066c04defeb037f53012da66f5cd9fbeccc48cc
SHA5129cd5b8e00d5644a222b78a1292e4dd5b674ff6fd276c307b568d7b017b0ac5ee658e1da04495f932a4d21efe1bc678470897d732090e2f4d7d70fc99cd07c121
-
C:\Users\Admin\AppData\Roaming\Jadaa\zeehy.exeFilesize
312KB
MD5cb55789a12e7c975ebad791571683774
SHA1986cf07ed4942569088dced3fdfb8154fe095d20
SHA256deaffa3fc053c2d85f8109e89066c04defeb037f53012da66f5cd9fbeccc48cc
SHA5129cd5b8e00d5644a222b78a1292e4dd5b674ff6fd276c307b568d7b017b0ac5ee658e1da04495f932a4d21efe1bc678470897d732090e2f4d7d70fc99cd07c121
-
\Users\Admin\AppData\Roaming\Jadaa\zeehy.exeFilesize
312KB
MD5cb55789a12e7c975ebad791571683774
SHA1986cf07ed4942569088dced3fdfb8154fe095d20
SHA256deaffa3fc053c2d85f8109e89066c04defeb037f53012da66f5cd9fbeccc48cc
SHA5129cd5b8e00d5644a222b78a1292e4dd5b674ff6fd276c307b568d7b017b0ac5ee658e1da04495f932a4d21efe1bc678470897d732090e2f4d7d70fc99cd07c121
-
memory/280-94-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/280-96-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/280-105-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/280-99-0x00000000000671E6-mapping.dmp
-
memory/280-98-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/280-97-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/468-106-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/468-107-0x00000000010E0000-0x0000000001139000-memory.dmpFilesize
356KB
-
memory/468-71-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/468-63-0x00000000010E0000-0x0000000001139000-memory.dmpFilesize
356KB
-
memory/468-59-0x0000000000000000-mapping.dmp
-
memory/1132-68-0x0000000001C80000-0x0000000001CC4000-memory.dmpFilesize
272KB
-
memory/1132-69-0x0000000001C80000-0x0000000001CC4000-memory.dmpFilesize
272KB
-
memory/1132-70-0x0000000001C80000-0x0000000001CC4000-memory.dmpFilesize
272KB
-
memory/1132-72-0x0000000001C80000-0x0000000001CC4000-memory.dmpFilesize
272KB
-
memory/1132-66-0x0000000001C80000-0x0000000001CC4000-memory.dmpFilesize
272KB
-
memory/1192-76-0x0000000001AE0000-0x0000000001B24000-memory.dmpFilesize
272KB
-
memory/1192-75-0x0000000001AE0000-0x0000000001B24000-memory.dmpFilesize
272KB
-
memory/1192-78-0x0000000001AE0000-0x0000000001B24000-memory.dmpFilesize
272KB
-
memory/1192-77-0x0000000001AE0000-0x0000000001B24000-memory.dmpFilesize
272KB
-
memory/1208-56-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1208-102-0x00000000001E0000-0x0000000000224000-memory.dmpFilesize
272KB
-
memory/1208-88-0x00000000001E0000-0x0000000000224000-memory.dmpFilesize
272KB
-
memory/1208-89-0x00000000001E0000-0x0000000000224000-memory.dmpFilesize
272KB
-
memory/1208-90-0x00000000001E0000-0x0000000000224000-memory.dmpFilesize
272KB
-
memory/1208-57-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1208-54-0x0000000000AA0000-0x0000000000AF9000-memory.dmpFilesize
356KB
-
memory/1208-55-0x00000000759C1000-0x00000000759C3000-memory.dmpFilesize
8KB
-
memory/1208-91-0x00000000001E0000-0x0000000000239000-memory.dmpFilesize
356KB
-
memory/1208-62-0x00000000001E0000-0x0000000000239000-memory.dmpFilesize
356KB
-
memory/1208-61-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1208-100-0x0000000000AA0000-0x0000000000AF9000-memory.dmpFilesize
356KB
-
memory/1208-101-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1208-87-0x00000000001E0000-0x0000000000224000-memory.dmpFilesize
272KB
-
memory/1252-81-0x0000000002A90000-0x0000000002AD4000-memory.dmpFilesize
272KB
-
memory/1252-84-0x0000000002A90000-0x0000000002AD4000-memory.dmpFilesize
272KB
-
memory/1252-83-0x0000000002A90000-0x0000000002AD4000-memory.dmpFilesize
272KB
-
memory/1252-82-0x0000000002A90000-0x0000000002AD4000-memory.dmpFilesize
272KB