Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31-03-2024 03:46
General
-
Target
2024-03-31_392c778d455e873a4839f7994e52d28e_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
392c778d455e873a4839f7994e52d28e
-
SHA1
b187e7d3386e68ba83338460bd45a31bd53acb7c
-
SHA256
016ffbdc7bc393e6d1c51e18d1525a1e558f9537f637fb1ea75cc37799204ab9
-
SHA512
10904b61373d4eb881e7aa7c5a0ffb811f8b02a2c6b954d7d0fd5bfedaaeb748dd4dbe630c0ae4734b800cfb5e9f6024c2e7c7ee4596db57186b12ebeafb04a8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 50 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-31_392c778d455e873a4839f7994e52d28e_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-31_392c778d455e873a4839f7994e52d28e_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XnkZdoJ.exeC:\Windows\System\XnkZdoJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHRRbUo.exeC:\Windows\System\MHRRbUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jUHVqyd.exeC:\Windows\System\jUHVqyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sbiVOLO.exeC:\Windows\System\sbiVOLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\polQNqs.exeC:\Windows\System\polQNqs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GMVMfAr.exeC:\Windows\System\GMVMfAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaBNieV.exeC:\Windows\System\oaBNieV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKyzXPP.exeC:\Windows\System\ZKyzXPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNcnnnS.exeC:\Windows\System\eNcnnnS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXdJRpK.exeC:\Windows\System\vXdJRpK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DYFSKFQ.exeC:\Windows\System\DYFSKFQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOcYQui.exeC:\Windows\System\pOcYQui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWyQqwx.exeC:\Windows\System\JWyQqwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGvhMtx.exeC:\Windows\System\LGvhMtx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfbwsyZ.exeC:\Windows\System\cfbwsyZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCzzVos.exeC:\Windows\System\yCzzVos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UeOTrAc.exeC:\Windows\System\UeOTrAc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kiLMYDO.exeC:\Windows\System\kiLMYDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYKZOin.exeC:\Windows\System\KYKZOin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJLrvOm.exeC:\Windows\System\sJLrvOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lGjXbJR.exeC:\Windows\System\lGjXbJR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f286c9bb6ffa10202a9f3a5ab975c8fe
SHA19be567271c5a888682173d787609d6931754e894
SHA256b5463fa2f90bb06aac7dfe9eacc87555081f92cbaa82d40a898833c36ca04a6a
SHA5127e4020781f11cde9d37162b23ea0aab6b62f553f07e8e31c29bcc30cebb64c129c35401cfa1282402173d9559b97333cc5dd68cd7e6a02d333fc972a1d463202
-
Filesize
5.2MB
MD5da4e9ebb5878a99d93cbec96bf402158
SHA1e0b5810b0c44b164f763035ab51dfda1aa516e99
SHA25689aa7c6d349657aa73cd8b40c42e4b198ef67fe73fba142a0088b1dc6488bfa5
SHA512223b384534b90101022b7f6a652df026b929b60265145f1e3e715e9bf6e426bdf0731d82495476eb24ffe1184c29eca81a5dc0c98c02def0718b1788e05f5816
-
Filesize
5.2MB
MD5d18727ba5fa2835fb96dcf16d2a1142f
SHA1ff7e3c808fb370b03199a655968aef5dd679732a
SHA256db9d61db307897878c8a23b7bf29c2bf557892baded7652c96a133d12b20ef63
SHA51218578b51796a59e4f4300d6088e8eca1600c405b659916ad43c777bea027425c26d45b8015e8a30714c24caef968d769147a8aa4810824f98b1dae65ca5ad7bb
-
Filesize
5.2MB
MD5ce491bc1894e0d640e564e8335658296
SHA1e468a87caf7049077627f17360826c970458c450
SHA256ddfe539904c7e44b0346586b15d8434c6afd91f3312c85921c5c98480eabb009
SHA5128ba74d0f8f883fd79adebf6f2659a6ea3adcab4065c9c60e3ca99fdb3ebb916763fad9e51ec6ac17151162990f66f10c45c0f60fa14c1fb97fd8235c9c376690
-
Filesize
5.2MB
MD5caaebbc21da4a22b8eae745fb8a4d812
SHA1998c83cd2d41c36770951659a8efbe3cdbc4fe4b
SHA256f799227e253771582e32c98a080051265464fb49539acc7a414382a7acb056a4
SHA5120c1278b9d14d8fb93aec9f9d1006a3e6e53a1d1d21c985cd37bdb81c8845d157524bec9fbae0adb7954317785727279f74622594c356c2f945d0b16d0fd54fa5
-
Filesize
5.2MB
MD5b9723019dc303e969cde433a58bfd331
SHA112137b70d75bda290092fe48565fcfd2de29b127
SHA256d41f2018f5fd4b6d4f130357cf692b9cb8340b3bf43d9118f40d9b781728fd04
SHA512c2e1b36aa5aa0a17086ddeb234a2b114e858b23b4b35f68b8a0a67c17250bdd21f964d480661b3f4056679e6e2f1ce8f875f84e0cd17ffccb1a71c9782e80ef1
-
Filesize
5.2MB
MD5a11c8a77a0c87a04cd280230c4ab3e0a
SHA175946ce3a440212a509f237b426629656061fc5d
SHA256f7948fdd1fd649a65824728ba83ca6e826339246976ae45799ed967eec3863d1
SHA512289f35bc397f83bfb7cb8a5d9ff53b69a8959dc71560c9b1621819d5bc3d5a3e5f06f0ba28dfda6d77ec5415294aa53b1d350ec30dea78b557c231527d858311
-
Filesize
5.2MB
MD53626814250f5878b5e3bc442a68535c6
SHA1a1cb214faff4572023babbcffbe4588f20ff0f3b
SHA256d1fdbd987cc9a9c9c64c53251d07cfe45b22bb5ba72e49be7b7046a3121d6a15
SHA512d5d2a6370e368ee1eeb361d53d36b423fcb4d18e1af843d21eb39e6ec2c561f6c29be2aae46dec74db452b17d5b7f0a4b1debc4c2beae22d202ce3f65831af29
-
Filesize
5.2MB
MD592b64ff861434d29d661f60e4402d796
SHA15decb931da4e7aaf9a997b4abaa9892f151425b4
SHA25675046760f8eb9e7b8469fad72724caf434f5c6aa363cd5d403058ad3f26feae3
SHA512ef0a04eb020e790fab8f8ac863de599cc91554c21377f9190385e9156889b5985f70022519c8e7c536ad573ed9d96b650cdae05f1e6f822c7b85bda29ebf385f
-
Filesize
5.2MB
MD5513f0742ebe2413a9f3643b80f45895e
SHA11eee13d755f9ca0cb4e9322d48a389dd4072ffbe
SHA256272091c597eca50ee492d29eab0e5eef3a33bac200c36bcd7047091969f263c8
SHA512760d74848d57329544f8952b49ce38f255cd7f247544a9959dbe3bd8280b826f840ddd8de75315c650e3e107acf0977e75f869bab0a588a81d89007d13f789ec
-
Filesize
5.2MB
MD55df61e0d448202b2f22b1fa7f6f9cdfc
SHA1c5430760eb5d1fae3c9639741b2cfaae2b67f4f3
SHA2565f2cd2c88829357b4aa883492ef0d0eaaeb7cf5fe2000666d0bb73e412e47f94
SHA51268dda89dd357410326678bd88ce1bdc955cc866ff57b282aa57fe3dd522715c5ce546c1fc0707e826d489a20c07191a63fa3ac01b372f49fefe13a77d42351cc
-
Filesize
5.2MB
MD52710cc330fef3db109bc6702039266f2
SHA1e07a9a3ec3fa1197dfe6436f9a5d7e764dbb1ec6
SHA256f05e6562be0036de217243b5da7b17b4f5804fa9f641a57919ddff46ee461dfe
SHA512644ead6a4ba4e78af3e1dead93babe5a7f0d4c04054fcdf4d080a30a5a5c523b31bf511029775131c72f14c60ba74dc2479d24eb72b773166a8fb12545d25246
-
Filesize
5.2MB
MD5d7781d8fc80812cec58aa6ddc9769980
SHA10395deaaf4de7240ce4a75c205e12dc2ce8542b5
SHA256ed32887446e3fea4e67a271ce3c6c9295982ea6da57bc0e504f75c24f235622e
SHA51248f2a7fc7732e582570d499edc4888f77708231e94ea7aa971ab1a34e242f7ac50408d9d23360cadc8592d5524916eb33b361ac959162a302737fe5f8382e563
-
Filesize
5.2MB
MD558e46199d08f6d48f8ccb8e5c401ba95
SHA1e0250975fbe06fcf961a482e9107337c4486872f
SHA256eda55f79403ade2feb029d0bf9ae26c4ea276a6a4b3224d1ee01f9152ed6fba4
SHA512cea64e2a8b0cb95af8e72f86afd06cc14dd81a84aa472b691c32731d340c204124a4bf238bcbdd137c9ab9ed5af71a5dbb208a1d99a28ab7083a75e4084a00cd
-
Filesize
5.2MB
MD55b633636f5853756944c09f2790ff07e
SHA1093122475ee8c5d7d0a2fca228729e47e57037c9
SHA256f9bcd0e797e153cddf4831770430185c7e24bce5b77138c16c7ee8d6aa28173b
SHA512d5bb8e21902177bd9355589fa2a76ad40bf3fc57498dde3fb07b071570b02bb8cf79cff66d897518034c01154fe58d6f8b0890f4baceccba6dd27b38934e09e5
-
Filesize
5.2MB
MD503bc4f6317e51b1bb39f7b1db7e9a6a9
SHA16d49057df0e845480715f89696eaeef48952a627
SHA256faae54cfe2a28a0eba4919654ca0ab168eb2a786f2cf771bcc007b2405df43ef
SHA5125dce8c733e32086c56c9760734e648dc1a357532cbf76966872e69abc4b8b7ce02a519e6bbe5dfaa95bcce25802e7f77def7e378e5f89e374581abf43b6a4273
-
Filesize
5.2MB
MD5e8ca004b92b8b938a47f192db63a934a
SHA15666bd0175e285080f8d8bb751281fd4eedfc50c
SHA256d9785d9ccd8bc323221ea4a567b6162199b53051040d26b3f1e0089ab4dce544
SHA512255f69493142019228757d437217bbc82c438a7c1d16c04f0613242402425f62bec8543f3c034feafab6119701e9adca4d245870395d3ecc23d6b9b65ec32c28
-
Filesize
5.2MB
MD558a8d157c935da5352fd5932ae54cfe4
SHA12513db2c41f612fb2c246e28fe9b8c56329dcd09
SHA25640b340488741540be6f7fdda35dc1c4e9e705394bc136bdcb4168de9509f5687
SHA51217978e23577c14d024eec4314ffa62c5ca1d0e66de02c0214e4a5819895b68bb7c6353e125a0b4ba881bdf83870cc8f85420cfaf6456b116872123f52cd709b4
-
Filesize
5.2MB
MD577a3c3956a01043a7e7dd2dbce33ac9a
SHA10e98af32ff7633b37edb50703ad52ae7b3bbcb6a
SHA25642b4f27be5643b6a9c6e324bee0496617b80c464e2bfacfdd039a7a9be33ec63
SHA512d5dfae780867642723f9c358a3a9d8b7814052f169b1b0e16f3fda4b7486ee3ff829ab6eb542cfc0c0965922568da932ccff7eb3ece2457dd3671cca9ae02859
-
Filesize
5.2MB
MD5c8d346e91096cd70998adca4651e3d82
SHA1f34c7b2301190b52af2afd82ab0f72e6078dba93
SHA256bd212e7e1999f705d5950510cf89fd8c03999267646dabc927a911e0b756b5f2
SHA512753b67fb44703f7dc37812514ee52912655e1bcd46e0c15d19627b57d7ae14f9dac302359bce712a660c2d7cded2ef07482a46da845f394a8630b3f7cb831bfe
-
Filesize
5.2MB
MD5d4f0c4e1fa86d841a9ef3c0855b4c464
SHA1e90cf70087bca376274c607ac4a17783ea6cf039
SHA2563a879cecac514b8bf30a88102f098ab32add4c873dbd3020a16a9d1cd1551d6b
SHA512ddf84a68ebe0719ba969df481dbfaa938ed860c6e0936a4c3f33f736ff5b2cdc3352549e009ad06d0c285f36b0363d0136f2aad149694f7be4013f244ccb8de1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB