Analysis
-
max time kernel
168s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:43
Behavioral task
behavioral1
Sample
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe
Resource
win10v2004-20220812-en
General
-
Target
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe
-
Size
307KB
-
MD5
3498c294883156b4076ce82826b1591d
-
SHA1
99167ba4c13df8c3da314ad8e257022539669c7f
-
SHA256
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc
-
SHA512
96b24265da685ce6f14a9c979c67140befcc3d82fe8a4402edd5875040ded2fe562e85864506b384899e707d9b253421d56d7a1f0931c01eba5b76248d9dae5e
-
SSDEEP
6144:2qzIT72Y0S+zinYKTY1SQshfRPVQe1MZkIYSccr7wbstOEPECYeixlYGicMX:2Ck7SSpYsY1UMqMZJYSN7wbstOE8fve9
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 1 IoCs
Processes:
qexoj.exepid process 980 qexoj.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1892 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exepid process 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
qexoj.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\Currentversion\Run qexoj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7BD94DA8-4FEF-AD4D-5225-887A4931AB67} = "C:\\Users\\Admin\\AppData\\Roaming\\Feju\\qexoj.exe" qexoj.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exedescription pid process target process PID 904 set thread context of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe -
Processes:
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Privacy b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
qexoj.exepid process 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe 980 qexoj.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exeqexoj.exedescription pid process target process PID 904 wrote to memory of 980 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe qexoj.exe PID 904 wrote to memory of 980 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe qexoj.exe PID 904 wrote to memory of 980 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe qexoj.exe PID 904 wrote to memory of 980 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe qexoj.exe PID 980 wrote to memory of 1228 980 qexoj.exe taskhost.exe PID 980 wrote to memory of 1228 980 qexoj.exe taskhost.exe PID 980 wrote to memory of 1228 980 qexoj.exe taskhost.exe PID 980 wrote to memory of 1228 980 qexoj.exe taskhost.exe PID 980 wrote to memory of 1228 980 qexoj.exe taskhost.exe PID 980 wrote to memory of 1368 980 qexoj.exe Dwm.exe PID 980 wrote to memory of 1368 980 qexoj.exe Dwm.exe PID 980 wrote to memory of 1368 980 qexoj.exe Dwm.exe PID 980 wrote to memory of 1368 980 qexoj.exe Dwm.exe PID 980 wrote to memory of 1368 980 qexoj.exe Dwm.exe PID 980 wrote to memory of 1416 980 qexoj.exe Explorer.EXE PID 980 wrote to memory of 1416 980 qexoj.exe Explorer.EXE PID 980 wrote to memory of 1416 980 qexoj.exe Explorer.EXE PID 980 wrote to memory of 1416 980 qexoj.exe Explorer.EXE PID 980 wrote to memory of 1416 980 qexoj.exe Explorer.EXE PID 980 wrote to memory of 904 980 qexoj.exe b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe PID 980 wrote to memory of 904 980 qexoj.exe b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe PID 980 wrote to memory of 904 980 qexoj.exe b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe PID 980 wrote to memory of 904 980 qexoj.exe b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe PID 980 wrote to memory of 904 980 qexoj.exe b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe PID 904 wrote to memory of 1892 904 b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe"C:\Users\Admin\AppData\Local\Temp\b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Feju\qexoj.exe"C:\Users\Admin\AppData\Roaming\Feju\qexoj.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp81dc2727.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp81dc2727.batFilesize
307B
MD58d527a06f227fc0000f404aa3a76f3a7
SHA13991d138750d2c6128655fce27832ff360433539
SHA256d887e84eacd7c4880b4c0d3b8e15ad4830fdff8e1c93c71c7d6acc79cfdebf52
SHA512e1db70b3f018a3203cf9fe70321980d8f863098748f1aafc2e1fe7a73c1951ad535c99848b1666aad571ae872d6d97b1d612da97afe2cecdff34f59d64d8e9be
-
C:\Users\Admin\AppData\Roaming\Feju\qexoj.exeFilesize
307KB
MD5a94f568ace7cd56604c543ff6fc7e104
SHA146956787d41c7dad3145545c60f0304f0d359a57
SHA256dfea09ad21fe3367593f283d51d93821bd50085363e3b413e7e8eeb72e30a943
SHA512270ba9d7394f0d79dc13a10e6e6f7ea16ec63ca04dcf9969e2d132604ab497b220e0d7009073a3df3386598b7dae303a579df6595fb23a6fe2c1330226e7d62d
-
C:\Users\Admin\AppData\Roaming\Feju\qexoj.exeFilesize
307KB
MD5a94f568ace7cd56604c543ff6fc7e104
SHA146956787d41c7dad3145545c60f0304f0d359a57
SHA256dfea09ad21fe3367593f283d51d93821bd50085363e3b413e7e8eeb72e30a943
SHA512270ba9d7394f0d79dc13a10e6e6f7ea16ec63ca04dcf9969e2d132604ab497b220e0d7009073a3df3386598b7dae303a579df6595fb23a6fe2c1330226e7d62d
-
\Users\Admin\AppData\Roaming\Feju\qexoj.exeFilesize
307KB
MD5a94f568ace7cd56604c543ff6fc7e104
SHA146956787d41c7dad3145545c60f0304f0d359a57
SHA256dfea09ad21fe3367593f283d51d93821bd50085363e3b413e7e8eeb72e30a943
SHA512270ba9d7394f0d79dc13a10e6e6f7ea16ec63ca04dcf9969e2d132604ab497b220e0d7009073a3df3386598b7dae303a579df6595fb23a6fe2c1330226e7d62d
-
memory/904-62-0x0000000000440000-0x0000000000490000-memory.dmpFilesize
320KB
-
memory/904-58-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/904-99-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/904-57-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/904-54-0x0000000000900000-0x0000000000950000-memory.dmpFilesize
320KB
-
memory/904-100-0x0000000000440000-0x0000000000484000-memory.dmpFilesize
272KB
-
memory/904-56-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/904-89-0x0000000000440000-0x0000000000484000-memory.dmpFilesize
272KB
-
memory/904-88-0x0000000000440000-0x0000000000484000-memory.dmpFilesize
272KB
-
memory/904-87-0x0000000000440000-0x0000000000484000-memory.dmpFilesize
272KB
-
memory/904-86-0x0000000000440000-0x0000000000484000-memory.dmpFilesize
272KB
-
memory/904-55-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/904-98-0x0000000000900000-0x0000000000950000-memory.dmpFilesize
320KB
-
memory/980-105-0x0000000000C80000-0x0000000000CD0000-memory.dmpFilesize
320KB
-
memory/980-101-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/980-63-0x0000000000C80000-0x0000000000CD0000-memory.dmpFilesize
320KB
-
memory/980-60-0x0000000000000000-mapping.dmp
-
memory/1228-71-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/1228-66-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/1228-69-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/1228-70-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/1228-68-0x0000000000330000-0x0000000000374000-memory.dmpFilesize
272KB
-
memory/1368-76-0x00000000001A0000-0x00000000001E4000-memory.dmpFilesize
272KB
-
memory/1368-77-0x00000000001A0000-0x00000000001E4000-memory.dmpFilesize
272KB
-
memory/1368-75-0x00000000001A0000-0x00000000001E4000-memory.dmpFilesize
272KB
-
memory/1368-74-0x00000000001A0000-0x00000000001E4000-memory.dmpFilesize
272KB
-
memory/1416-80-0x00000000021E0000-0x0000000002224000-memory.dmpFilesize
272KB
-
memory/1416-83-0x00000000021E0000-0x0000000002224000-memory.dmpFilesize
272KB
-
memory/1416-82-0x00000000021E0000-0x0000000002224000-memory.dmpFilesize
272KB
-
memory/1416-81-0x00000000021E0000-0x0000000002224000-memory.dmpFilesize
272KB
-
memory/1892-96-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1892-97-0x00000000000671E6-mapping.dmp
-
memory/1892-94-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1892-95-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1892-92-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1892-104-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB