Analysis
-
max time kernel
165s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 16:00
Behavioral task
behavioral1
Sample
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe
Resource
win10v2004-20221111-en
General
-
Target
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe
-
Size
312KB
-
MD5
eeae2ca96761b0df98c83a7eae0c2ee9
-
SHA1
dd38b41dbd472d27c46b7e2c48afd211e3a59ce6
-
SHA256
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928
-
SHA512
3528f9c67a22e8b2ac9b11dc2598d5299f2a66adc5a55cffad4d1bc87dd919eab9cf2064035090ef1f2d24e9f3353d8f4ea5b8270d508e35e70bce32c2e93a9b
-
SSDEEP
6144:I+1VyBRl40pPGMHLdL1hALe+2NirdrQdZUwUKD0Ek:IEy94wGMdoLT2NKcCw8
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 1 IoCs
Processes:
xeev.exepid process 1712 xeev.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 360 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exepid process 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
xeev.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\Currentversion\Run xeev.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7B2FDFC8-3774-AD4D-C411-AE4FF0968D52} = "C:\\Users\\Admin\\AppData\\Roaming\\Joapmi\\xeev.exe" xeev.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exedescription pid process target process PID 1360 set thread context of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe -
Processes:
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Privacy a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
xeev.exepid process 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe 1712 xeev.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exexeev.exedescription pid process target process PID 1360 wrote to memory of 1712 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe xeev.exe PID 1360 wrote to memory of 1712 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe xeev.exe PID 1360 wrote to memory of 1712 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe xeev.exe PID 1360 wrote to memory of 1712 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe xeev.exe PID 1712 wrote to memory of 1148 1712 xeev.exe taskhost.exe PID 1712 wrote to memory of 1148 1712 xeev.exe taskhost.exe PID 1712 wrote to memory of 1148 1712 xeev.exe taskhost.exe PID 1712 wrote to memory of 1148 1712 xeev.exe taskhost.exe PID 1712 wrote to memory of 1148 1712 xeev.exe taskhost.exe PID 1712 wrote to memory of 1240 1712 xeev.exe Dwm.exe PID 1712 wrote to memory of 1240 1712 xeev.exe Dwm.exe PID 1712 wrote to memory of 1240 1712 xeev.exe Dwm.exe PID 1712 wrote to memory of 1240 1712 xeev.exe Dwm.exe PID 1712 wrote to memory of 1240 1712 xeev.exe Dwm.exe PID 1712 wrote to memory of 1272 1712 xeev.exe Explorer.EXE PID 1712 wrote to memory of 1272 1712 xeev.exe Explorer.EXE PID 1712 wrote to memory of 1272 1712 xeev.exe Explorer.EXE PID 1712 wrote to memory of 1272 1712 xeev.exe Explorer.EXE PID 1712 wrote to memory of 1272 1712 xeev.exe Explorer.EXE PID 1712 wrote to memory of 1360 1712 xeev.exe a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe PID 1712 wrote to memory of 1360 1712 xeev.exe a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe PID 1712 wrote to memory of 1360 1712 xeev.exe a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe PID 1712 wrote to memory of 1360 1712 xeev.exe a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe PID 1712 wrote to memory of 1360 1712 xeev.exe a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe PID 1360 wrote to memory of 360 1360 a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe"C:\Users\Admin\AppData\Local\Temp\a68242d22925acc952c9b32bf7fe87ee782e592985dee1dcdbcfd6dbe7859928.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Joapmi\xeev.exe"C:\Users\Admin\AppData\Roaming\Joapmi\xeev.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp639fb72b.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp639fb72b.batFilesize
307B
MD50e39851e08d73fde5295601a232ac961
SHA1946774c7630e295e79e65eac74c1547530343a42
SHA25642686be1214782021b1e8bf00a9cbfb6dd544e22b2a8bd9e00e4dc2fb602aa70
SHA512ab4d3008c3c3e1f53f49c330cfcf8c764e91d5fbf1759fc9df27664cf1725d33f0c6e577091e8ba39086ab2945fe7d4e2859d999807510922862a43f95afe342
-
C:\Users\Admin\AppData\Roaming\Joapmi\xeev.exeFilesize
312KB
MD50103ac7703b17b1b186ffa7189c31d93
SHA1299842d4cb0ead8e253a8827dbb50d93128475ad
SHA25632b7ff43d2a5af83aaa69ac73d6b71bda3fd9df6fadf90ebd7f778d3e98c0022
SHA512516056aa9591a362c580c3d1fe915d670634cc5cd128f2dd5aca77412442cad34fe417e738d26ecefe6da91c45cb84f29b92815ee754e4c7284f07688bf9c4e2
-
C:\Users\Admin\AppData\Roaming\Joapmi\xeev.exeFilesize
312KB
MD50103ac7703b17b1b186ffa7189c31d93
SHA1299842d4cb0ead8e253a8827dbb50d93128475ad
SHA25632b7ff43d2a5af83aaa69ac73d6b71bda3fd9df6fadf90ebd7f778d3e98c0022
SHA512516056aa9591a362c580c3d1fe915d670634cc5cd128f2dd5aca77412442cad34fe417e738d26ecefe6da91c45cb84f29b92815ee754e4c7284f07688bf9c4e2
-
\Users\Admin\AppData\Roaming\Joapmi\xeev.exeFilesize
312KB
MD50103ac7703b17b1b186ffa7189c31d93
SHA1299842d4cb0ead8e253a8827dbb50d93128475ad
SHA25632b7ff43d2a5af83aaa69ac73d6b71bda3fd9df6fadf90ebd7f778d3e98c0022
SHA512516056aa9591a362c580c3d1fe915d670634cc5cd128f2dd5aca77412442cad34fe417e738d26ecefe6da91c45cb84f29b92815ee754e4c7284f07688bf9c4e2
-
memory/360-94-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/360-97-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/360-102-0x00000000000671E6-mapping.dmp
-
memory/360-98-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/360-96-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/360-106-0x0000000000050000-0x0000000000094000-memory.dmpFilesize
272KB
-
memory/1148-71-0x0000000001E00000-0x0000000001E44000-memory.dmpFilesize
272KB
-
memory/1148-66-0x0000000001E00000-0x0000000001E44000-memory.dmpFilesize
272KB
-
memory/1148-68-0x0000000001E00000-0x0000000001E44000-memory.dmpFilesize
272KB
-
memory/1148-69-0x0000000001E00000-0x0000000001E44000-memory.dmpFilesize
272KB
-
memory/1148-70-0x0000000001E00000-0x0000000001E44000-memory.dmpFilesize
272KB
-
memory/1240-74-0x0000000001A80000-0x0000000001AC4000-memory.dmpFilesize
272KB
-
memory/1240-75-0x0000000001A80000-0x0000000001AC4000-memory.dmpFilesize
272KB
-
memory/1240-76-0x0000000001A80000-0x0000000001AC4000-memory.dmpFilesize
272KB
-
memory/1240-77-0x0000000001A80000-0x0000000001AC4000-memory.dmpFilesize
272KB
-
memory/1272-83-0x0000000002910000-0x0000000002954000-memory.dmpFilesize
272KB
-
memory/1272-80-0x0000000002910000-0x0000000002954000-memory.dmpFilesize
272KB
-
memory/1272-81-0x0000000002910000-0x0000000002954000-memory.dmpFilesize
272KB
-
memory/1272-82-0x0000000002910000-0x0000000002954000-memory.dmpFilesize
272KB
-
memory/1360-99-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1360-54-0x0000000001300000-0x0000000001359000-memory.dmpFilesize
356KB
-
memory/1360-89-0x0000000000180000-0x00000000001C4000-memory.dmpFilesize
272KB
-
memory/1360-57-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1360-87-0x0000000000180000-0x00000000001C4000-memory.dmpFilesize
272KB
-
memory/1360-91-0x0000000000180000-0x00000000001C4000-memory.dmpFilesize
272KB
-
memory/1360-86-0x0000000000180000-0x00000000001C4000-memory.dmpFilesize
272KB
-
memory/1360-103-0x0000000001300000-0x0000000001359000-memory.dmpFilesize
356KB
-
memory/1360-62-0x0000000000510000-0x0000000000569000-memory.dmpFilesize
356KB
-
memory/1360-55-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/1360-61-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1360-88-0x0000000000180000-0x00000000001C4000-memory.dmpFilesize
272KB
-
memory/1360-56-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1360-101-0x0000000000180000-0x00000000001C4000-memory.dmpFilesize
272KB
-
memory/1712-90-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1712-100-0x000000007EF60000-0x000000007EFA4000-memory.dmpFilesize
272KB
-
memory/1712-59-0x0000000000000000-mapping.dmp
-
memory/1712-63-0x00000000012E0000-0x0000000001339000-memory.dmpFilesize
356KB
-
memory/1712-107-0x00000000012E0000-0x0000000001339000-memory.dmpFilesize
356KB