MALICIOUS — 904_WinX.OperationDianxun.bin

MALICIOUS — 904_WinX.OperationDianxun.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the CobaltStrikeLoader family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 0d7d4dc173c88c4f72c8f9f419ae8473d044f4b3e8f32e4a0f34fe4bbc698776
• SHA-1: 0690a1107b8e7b596eab722e360bcc6b30acc897
• MD5: 60d083b7c74cc84f38074a5d02a2c07c
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 768:whz7PNtOMVs1LEdalC/ZgJsECngpiIpm6X2hZIXxMP8eciHC6nNKNX8EbUOiowY:kz7VtOMMqKCBgJLCngpiIw6X2hZIXxM
• TLSH: T13F30F69A52C37317C3F78D552060D5BE508678C9A9F23FCD070281B2A4B0E2789A65FE
• Submitted as: 904_WinX.OperationDianxun.bin
• File type: pe · Size: 38400 bytes
• Verdict: malicious (100/100) · Family: CobaltStrikeLoader

Detections (7 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:execution/powershell
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Microsoft Defender: Backdoor:MSIL/CobaltStrikeLoader.F!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Razy.803392
• Trellix Stinger (McAfee): Trojan-FSZC!60D083B7C74C
• Kaspersky (KVRT): UDS:Trojan.MSIL.Zenpak.gen

MITRE ATT&CK

• T1059.001
• T1055
• T1543.003
• T1112

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged Backdoor:MSIL/CobaltStrikeLoader.F!MTB (rule Backdoor:MSIL/CobaltStrikeLoader.F!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.803392 (rule Gen:Variant.Razy.803392) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FSZC!60D083B7C74C (rule Trojan-FSZC!60D083B7C74C) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.MSIL.Zenpak.gen (rule UDS:Trojan.MSIL.Zenpak.gen) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://flash-update.buyonebuy.top/flach.php, https://flash-update.buyonebuy.top/download.php?raw=1, http://159.138.84.217:81/c0c00c0c/AddTaskPlanDllVerson.dll - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4433 behavior events · 2 ATT&CK techniques · 6 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6601/files/d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9 - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
• /opt/CAPEv2/storage/analyses/6601/files/a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93 - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
• f6590c457b13428acec523f493bb251cfdae1ffb0505541c03d68e68d4f9d173 - f6590c457b13428acec523f493bb251cfdae1ffb0505541c03d68e68d4f9d173
• 2999d73cebf160a44c741183f7b63b42fa9ac0cb9014ea83846db2119e1e70d5 - 2999d73cebf160a44c741183f7b63b42fa9ac0cb9014ea83846db2119e1e70d5
• 7476a0c6a1d6d9c3f28f436ec53b8cdee5b5662bfc382f615e37af01039b2fec - 7476a0c6a1d6d9c3f28f436ec53b8cdee5b5662bfc382f615e37af01039b2fec
• d57e093e14fd75086a5f2a8f2024181900822def9286ef115c78ce3621cf4e65 - d57e093e14fd75086a5f2a8f2024181900822def9286ef115c78ce3621cf4e65

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://flash-update.buyonebuy.top/flach.php
• https://flash-update.buyonebuy.top/download.php?raw=1
• http://159.138.84.217:81/c0c00c0c/AddTaskPlanDllVerson.dll
• http://update.flach.cn/download.php?raw=1

Embedded domains

• schemas.microsoft.com
• flash-update.buyonebuy.top
• update.flach.cn

Embedded IP addresses

• 159.138.84.217

File paths

• C:\Windows\explorer.exe

More CobaltStrikeLoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report