Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
31-03-2024 03:46
General
-
Target
2024-03-31_392c778d455e873a4839f7994e52d28e_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
392c778d455e873a4839f7994e52d28e
-
SHA1
b187e7d3386e68ba83338460bd45a31bd53acb7c
-
SHA256
016ffbdc7bc393e6d1c51e18d1525a1e558f9537f637fb1ea75cc37799204ab9
-
SHA512
10904b61373d4eb881e7aa7c5a0ffb811f8b02a2c6b954d7d0fd5bfedaaeb748dd4dbe630c0ae4734b800cfb5e9f6024c2e7c7ee4596db57186b12ebeafb04a8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 52 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-31_392c778d455e873a4839f7994e52d28e_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-31_392c778d455e873a4839f7994e52d28e_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aPNEoOB.exeC:\Windows\System\aPNEoOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqKRdvd.exeC:\Windows\System\hqKRdvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLjAzJg.exeC:\Windows\System\SLjAzJg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjMnjnH.exeC:\Windows\System\SjMnjnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FPaLiPn.exeC:\Windows\System\FPaLiPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVAAtaL.exeC:\Windows\System\IVAAtaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yDqpaTe.exeC:\Windows\System\yDqpaTe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRsvcRs.exeC:\Windows\System\sRsvcRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpUCTNU.exeC:\Windows\System\gpUCTNU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PGvaaun.exeC:\Windows\System\PGvaaun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aslrxsL.exeC:\Windows\System\aslrxsL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poXGwcQ.exeC:\Windows\System\poXGwcQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PeOcKCr.exeC:\Windows\System\PeOcKCr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTBMSYL.exeC:\Windows\System\fTBMSYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDEmvNJ.exeC:\Windows\System\bDEmvNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZfDdXn.exeC:\Windows\System\IZfDdXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leUCVdI.exeC:\Windows\System\leUCVdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieqUhcU.exeC:\Windows\System\ieqUhcU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DyKmEBE.exeC:\Windows\System\DyKmEBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HttVsKr.exeC:\Windows\System\HttVsKr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzquaMi.exeC:\Windows\System\xzquaMi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD519249cb8cb74fa4a2991d25e08ed831e
SHA1b1fa0f37cab050e169fa2b3fe90ad32860475278
SHA2560db227267331b7c488ac421de184724e1e75ad509bef1c4671b7eadb99b9e426
SHA5128a7fd8e19d8b4cb31175681b450bcb243900c25f3ea50e2fb39ad0287102e809808220943168f361be69637c043608274bde6f36b02866cda3e4ce1ebf23aa22
-
Filesize
5.2MB
MD596471e16c037eada448a3ccf69be9dcb
SHA114f5f288e6f511ad6cecb3e3601e70b8a1a079cd
SHA25669f1c1c041007b45e9c814bea056b2386942ff8896304ee1cb6915dae0002fda
SHA51203e7cd26c4d445721acbfa584709bf782d2024cde4837827f6eaad6ad52ff247b190fc5d53611cca05f9a8ed792bb48c452ff429c7d433cec5f4e7deab9e1eef
-
Filesize
5.2MB
MD56a3eb37c5d1c01756c0c42d07b78bf80
SHA199ec465ef7f6f27f4618177278a1b3ee726e589f
SHA256c2238f1058ad62ab2d9da8a8755ab66fa70d7689bd8713303eaedcec8b644bd9
SHA5123c6fa927c3e689056dd8002ca3df3f7c86f2dedb001d650fe33399b2552f089157a3a2421631f78c4ca9e2f4f75cef156def0af77dae3b95573a802d99d2a53f
-
Filesize
5.2MB
MD5e17b69c5e900b1be589507ef29a6c1ce
SHA1c2a5783fa4ebab74731c931994a72a194ce58201
SHA256a1c61d401fe0539572c7656b403a040b0f07cd2f42c06f7c8c3c3d45aa6df338
SHA512ff0baf9770442e43b331131f95677317388442e49bccbf70082132ade23886263dac9112a7c7c4d1fb3858edece1937a7a5690a19b852b72153b186010d1f3f5
-
Filesize
5.2MB
MD5981be8508d481f0ed4e44334ba3bfc43
SHA1995f4c5b963798f430a627f181bf2b89b9961b04
SHA256701d971fcf06a90604dc572724ca6538365e356f28b3dacbace5b61ef70c95ca
SHA512929ba4f84a30484edf928601bea6ee330146e6f9ff8bcbff320eaec3ed28d329a1e71fee6536082ace246204d3da445df4febf599e84667ff050c91ef8872817
-
Filesize
5.2MB
MD51cb13e61e064e85efdf930d9de5cc0b9
SHA1ae26c70a645116f0144d01c9fe7cd6ebf26e6e07
SHA256f4ae2ea594fd9c225865042bc8c0c8377442c536c9363de7ec1a250ada13865e
SHA512ef286f45d122acd09cf056a61e7955ea285cd2567175a9790b392b7bc9c33019f54e55106271fc82d726ad90e3f0c74021a863f8e2fd6964c7d687e2bdaac918
-
Filesize
5.2MB
MD5484ddc78abcc708dc35b6524c60f3f77
SHA11326e26eb283187cfc7e03d65bbfe57f42dafebb
SHA25676c0be895c5bb6233127f93b10b78ec57d6ac4615d6eefa0c62f357779a2c8d7
SHA512c50e5528112515bb9cc5d47fb182b454fdd9046e0ec7650877a7d0f936441a6d4fe70fbb66fbec37f0a40b76b4da9391e5bb397ac7e94339818529f3cb5af50e
-
Filesize
5.2MB
MD54c564d38fc4996d5fd2f31ce808aba3a
SHA1692e10578fc58ff955eaff5b582a800af406d467
SHA25678995139b1e6aec8d25bc97c8ef246079903644ab1e0131d867012d19b73daac
SHA51213c78981ae01ad97b1ebe25bec7c1ae72a6bb3bffbd2ac7a931223bb40b9ad6af9ccdda8712c6b22dfcb2d1a90b2eda3e653c97bbf08bd2845faac54dd5bd461
-
Filesize
5.2MB
MD583f4c7daac593dd2940c16a971e73532
SHA18e753c48ab8af5307eba0a491d72ac381f72b00a
SHA2565bff7212093470a87ecac9aa15b0b10ec0391d00db7228fb3b6c9329710689ec
SHA5126f34c94c5238cb47ba6b591be04db51caa98a3716de109c0f940486f59f5c77e21e8d0c34e9b99a2fcd3c6d119141a445d27e2a9aad5c1bec65fc37853077c18
-
Filesize
5.2MB
MD542d12d2c4df08206dcf2ad7d79f57fe1
SHA13c9b37cc539e95b334b4b27477ef361afcf6fee8
SHA256f2d9ba00a87aa26b65b86d9034d3e4cb8f97fad32a893163a5bbddf9d2a23f7e
SHA51234f0847840bbfa220adc91136d9c46f68054d0e231293c6874d093c1db5c95c73130ba967098cc4904c25e196e576f4379a8050749840b70332381b8ce356246
-
Filesize
5.2MB
MD5984e117e71d140523d6803f7fef54934
SHA1ff7662dd64d0ed15ff17694fd3ea32cc65bc34e2
SHA256ff55073f574f25315fcf4d8d30f357213cb2ba3d7aff3f335b9c4231120d578a
SHA5127f5e02e5b34e3a1f28cb0a9f59786a3e1f8e2bc8ef59262c500da20ce4c621553453916a78b1440c8b9238a97dad0379b94d9ccf76f9908e03781a25487c945c
-
Filesize
5.2MB
MD5e7652bfca6ff22f4bfda3b1826add0e0
SHA1d83110bc78ceb078f5b537d15c8eba9fb537a80a
SHA25651eff941c574e133c3d0b3e80a7564cc896f69ffaff39f9e6d3686b9299e8411
SHA512c8cfcac5a477783a998b032b8c636e97ae0bdf9fa191a268753b96992630d0e2a014c13fe4742675169fcca868aefc2e9e13a1e528a9a7be7962d869baf52468
-
Filesize
5.2MB
MD50e47da57e9a4d9d349140751e58b6fd5
SHA1fa21af051f24f86f9fb1ba83d103167c3153c53e
SHA256fa71a52e88f65eb6ce77a80a5e0f2e9a1cce321ab521da5308dfd3bc2130e165
SHA512b1ce675bad9a802865f78acce600fb10b616d6ac99d447454a63340c6054e22a0ca3ed4ceac3190425462859ba35ba72a5ab23fe916a3d9b5af01466acf6cb0b
-
Filesize
5.2MB
MD5af34cf87133092b7abb12c1b31b97fcc
SHA15924b8fd181b4d6d2d280277127c55389c4727be
SHA2564f913dc6e443e97cfcbe1152eeee8645523dfb7566e55e36f2d9314b0d49beb3
SHA51290e0d54146e2204c68f23864ee6eea80a05ac659dd4c025636139bcb07504ca44c9af633aa176f31feaa6cf37348d0ddcb7550da8e598cc84ce7d2985103f972
-
Filesize
5.2MB
MD524dbd9b5f890956123a4b072cc207fe1
SHA147bf256be432b6c4586235a6c8853120b600232a
SHA256f4cffb5245e1cc09d899a9cff200ebaba6b0e663f7ac3f31a5f84405d5d28c5d
SHA512ca57ce5131a6397b370023f7ce48f6e6ee4351598fd150f1af0b1c31e94f8e0186d75d82b6c409775d4bbf9192d6b9fbb9573892c82a6abd0e0f4e3f392cbb58
-
Filesize
5.2MB
MD52c2ecd08b39fde412c07ea4bdca9302c
SHA13b08137cb449ec7d50760731b5de08018b5095d2
SHA256568321eb79044a9ecec9cb1a5a2b7b70d3f13570dd01577934a66d716fb6059b
SHA512ec361ce93391a84290604fcfd86c2742ed07c7dcdb87fbbf5f103f76171047c9c894c2615717e2e5f63a4d9aabdd924daf8d1e1e96a062cc20c065ae5c439599
-
Filesize
5.2MB
MD53d6df6d6e4f9c2cf8c37b3d61b924b09
SHA1d10c9faedd811fc70a8561f917e14acaef1e83fd
SHA256dd6000fcc7db47a9bd4b7af68acb765c8f3e7e8b64afcee92bbd7ee8ddc57cd8
SHA5124e545d33bd68d3a34a745a551bcc1a706aa906cccc505ae7c5256c87f430f5cdc06cfc8602891600028cf825f996ec7957417bdcb75a398e2fe0c6a2617b8de1
-
Filesize
5.2MB
MD583556ee6f9b3476105c4cc61946ef4cd
SHA18a9326b04d30d892362db5d0e4ab1d641eb60b9b
SHA256385eb1646ed74731d6a2960aa9c490f065436fdd6cf0528645c8638b786d09be
SHA512bb46d0a67dddfb8378a271a505afda99c2349b48620f6e0ab4548195a60155e4de5121d948589ea9ccf686e5d26063978fc5f83cecda3779d00beb01b665776e
-
Filesize
5.2MB
MD54736ca8806248a82f59dcc4555f9d72f
SHA1e657d547d08bb2018d6ab165a5e9ce2369217947
SHA256962ac8ba8b847fc0e64248ad92642b96e78bddc3a750c42839d425c4df9f78ba
SHA512c5ded826f967319a56535e53dc979b4ae56ec569f4b7b99a54f2e370c9b4baee6397bbc89980e78ce838faf7aff7a2e747984b0e3528089e7370f9c0797ccf22
-
Filesize
5.2MB
MD5e86252b9aea989c8e7ef7704db1dd92e
SHA1686316415e2853769d60531a71d51295b6005d9c
SHA256b020000522f719c3d0dead963a51c171122836dd4e6e2cba3c8506c56daa81eb
SHA5124ad53b4d21b7245e3c26c50122e11eae748870fbb545647a9c8e6a12e006ebf4a30cb5f44b219a263188226f8c0ca144b43a0799020a742d6e0a3fb6f8dce4eb
-
Filesize
5.2MB
MD5adf059cf237b7ee64c42801aabf84d88
SHA12c504ef2e48df04d0fc39c140db6bc0a53b822fe
SHA256388719bb05459593118f1eee090b15d8a20e417ecb97fe5324e249fcac1ebd16
SHA512e9931b19e558cfd1291c7fcddd12dc0013e908abbc7cf264fa2489e3d258db9e90a2afe2aa8923c5a75e2ceea9d9bb2c67cf4d2a979b0369af106b1cb33820be
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB