Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
31-03-2024 03:47
General
-
Target
2024-03-31_493e5f16ae4963318897783ba98e535c_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
493e5f16ae4963318897783ba98e535c
-
SHA1
0ca00c7ccfdc4c8454cb931689b68001a1776aad
-
SHA256
b280ce8371fe4f3667da2c3fb29b7e71ff944330ce4e3547bd3b0eb3bc010f35
-
SHA512
70c79c9b2b3b6aedba10bb3afce5260bc74b0a2286ffb8fff08de466d6058965d71eef431b32a9fec4e3a6bba770a0ef61ab9e3ac2433bee6ad148d33cf9a238
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-31_493e5f16ae4963318897783ba98e535c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-31_493e5f16ae4963318897783ba98e535c_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KNsrGgJ.exeC:\Windows\System\KNsrGgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqBXaCp.exeC:\Windows\System\PqBXaCp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpNpNxI.exeC:\Windows\System\vpNpNxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWEYTWS.exeC:\Windows\System\cWEYTWS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\acxdkFi.exeC:\Windows\System\acxdkFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QWGEPco.exeC:\Windows\System\QWGEPco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUtDQVn.exeC:\Windows\System\cUtDQVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BltFpsJ.exeC:\Windows\System\BltFpsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjYGFmY.exeC:\Windows\System\vjYGFmY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzhONaR.exeC:\Windows\System\KzhONaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzacCpu.exeC:\Windows\System\IzacCpu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aAnDjun.exeC:\Windows\System\aAnDjun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imYmica.exeC:\Windows\System\imYmica.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGSgAHK.exeC:\Windows\System\DGSgAHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wWGKBXn.exeC:\Windows\System\wWGKBXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UACcAHl.exeC:\Windows\System\UACcAHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtfpSME.exeC:\Windows\System\CtfpSME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTVwPME.exeC:\Windows\System\lTVwPME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyEvBUN.exeC:\Windows\System\QyEvBUN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNAoOkh.exeC:\Windows\System\dNAoOkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ozbOmEe.exeC:\Windows\System\ozbOmEe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f29df4273f92aa2613a62f884666f51c
SHA19572d94d29fb2aa829b7f18d067a6fc3fe2bf4df
SHA256de79dcc35a6c867fb9b5197a406ad31fc88e7cc51fc908e36b41342839c4f76f
SHA5125f7cec46f6d56aedfc4444f71ab43118214f1355f6bdb2cbf3023d5adb350173a0114d8ec55ffb9e9ccd90fbd9a1bfe45982ad1d9a6efd252c361b3836e36a4a
-
Filesize
5.2MB
MD5424d929d3741c6466afe8053a06e7221
SHA164588ca5b6290a2fdb0fc5c3f2c29ddeea82f697
SHA2566a610e984b13dfc5eab1b5254c86b47eeb0a9b9c00f80dae2e66972cee9fe00f
SHA512821716a8bbfb130f1561aa75b07c6cec2acd43993f5053f00b8bc73aeefefeaff1197a6d1484acb544bd6f7abe479a7774ae7ad9d383696ad9f1e177a5289340
-
Filesize
5.2MB
MD5c21ba653db051b188b07b22ac54bc6b0
SHA162a1afa1dcb9aaed7bc11603e4aae92165606544
SHA25654233bd2c449614fc3555683125c300289a2ee5bfac2e587999526b17ab033fd
SHA5124fc08fc9d83aa2d1f6d176c4a76c900d18a9ca9252fe3f81acf392ff0fb2a0ece10f0f8dddbe75915abd06ebccdd2099a3e2693cee06f5e4d048e40b0cd3b817
-
Filesize
5.2MB
MD59626833a14f59949a45269a08ce5acef
SHA17b021b1574809732fee031046be661ceaa9c09b8
SHA25688d54a24d7537a692d271fc2ba3c7e277ca495501f65d6589b4bdf3381dda0c6
SHA512cb33319af5b702da79f9dd5b880f959d4b8c8d7267f76ed464c1fc9b7cbf9abd2eca0764b78728f1f8c88f294d59b552417080e3d1f909f0436a5ddb0dde0724
-
Filesize
5.2MB
MD5df2c65bd607308c2bdb583896a64ff5f
SHA17aaf927e4359cda290c8b6475d59358722733b0d
SHA256113313755504d212d0b0c675bb2c8ae98bcfe53487190d63fc842586523cbd8a
SHA5126b3ba116811247fd159d7cfb68f0e11a80e3a00fd61ebb933e8b244f5a2ef0cf81aea786c535fa8720a498489002fab2ed4411b8a776e5d8b8f59cc84648571a
-
Filesize
5.2MB
MD57065de1a36f33fb2213d63e045572987
SHA185fdd3624e0e73ff51e253896c1b6b10f25c4b27
SHA256c373a9fa55ac37eeabe4295f7a8ea3e5a5aa737c98d5cdec1b01bdb9894485b9
SHA512f28e2666012a49c88468041878a0edfa1c3fdbd24528f32db1838e461dc07927678f31e9006ca4af76815b0004bceb7b2a68c26e982340e544e0b8b20eece2fd
-
Filesize
5.2MB
MD5ddf5e875412d5e913934ddd92e54c8ad
SHA1bf3b8023486e2fd275577746f2627a9bf755f4dd
SHA256fddcc00578728eb035c5258d00f9c6c87d17dac71921abf3eb167a6e2ee1b799
SHA51204075455597ddbbb9e6855fbaafd53accf39aae5d6422eea93767ce068055cde021929167be99c76ee4e09d189cefbaa414a20c311f70119815dcd767a25431f
-
Filesize
5.2MB
MD5fcd75b51463ad08d9657ffe199ea3f0c
SHA11b1910c787aa61b6e889a7108adeb1b78d777549
SHA2561a33c22de192fa65afbcd63a83beddf02c402e65107be9088b06bd8d55fa5825
SHA512a77a08814c30eafb4bd5ee82aef6d3e14889ea810b6396f3a7a2d15bce66937c6e2f30d74c4b2059a68c820cc39f764311de66c2051d6a580721e9702582de73
-
Filesize
5.2MB
MD576d40eb98ba2636e64d48beac0251309
SHA1632a7202b0f58a2bb74a7fa894f0bd7fef7b78ff
SHA256c7820d9346d2587f4f26d9fc8e317472f7d2815f23690398b32fd197d5b8db84
SHA512c583ee591c3c9e65816252b1a9bfe8551047f8c0730f00f82f2f5516a10ce68c33ad9cfd4210187b3f75cc824488223ad24d48777e8de1e4aaa31bc4923d721e
-
Filesize
5.2MB
MD53641477ab18338b7fe4e10fe8e361070
SHA18e3374d74cebcd553c9017f5cb68ee132bd4a4eb
SHA256656aeb2a3ca9d67139acd55374ef719a4134ac4964cf8964e43bcc30c145f91b
SHA512eb77cef6b26867f33981640f900cb91cb10e364b304dbf309256a679b3feaeb57439461cc8868a44e29cf3e37981c37ee54c337c856165717352f9c283133578
-
Filesize
5.2MB
MD582b2832ab5fa0b1a1cbde81b70fcdbb9
SHA165195181c21a004da7113ba28c98d0df6770118f
SHA2561a5c764cdcecdeb17336a69fdfd1dc5688bb07536f35d9c6d887c1b3832dbc57
SHA51299c50e6d254cfae1e4ccfade1a12ba26be35f94f2eb47b03cff2b353a0b5dfa12a586e63567dcc41d3e09f328934c80ea63eb9c090e36fb64284eda078eab0e4
-
Filesize
5.2MB
MD551b0316254ae30202fba43b855e49d6a
SHA188ccdb4cbcc3c828003b0f8d64d20fdde9710c82
SHA25663d0128c4b2eae1e9e3c434f831e2a5cca21295325f33d2147db34690ca2ae7f
SHA512706815cd1c04ad846506998fc706d278cf7abbf1d203fec13262c861ea2d30846fd29decad7dd9765612e17770f1bb38b97c676574517e1da87394c6c4ec870e
-
Filesize
5.2MB
MD5d1913063c771bbc7422558c81391071c
SHA13cc031a1d36870f6a7ed0bd46affb043990e7966
SHA2569057f0c84fd72f3ecf6728e582fa1db5b2ccdea654901c7fd43793f59f80ce88
SHA512541c24fca5483d9336e44a14c47c2f536200c551cfd78d75e3848ab67212a7ca1e730ed98b67c4b2cd0b1bd7d7c34540ca7ad1a6d2be5c0aa3329b428c733571
-
Filesize
5.2MB
MD5be551ddb843e692af61bc12af97f7722
SHA191fcecc6411304d33fac0357f54b8d5019c547e5
SHA256c8e5f83cda07e58d70e1e151a336cbd901c257e90be5452b480c7e3e46df6dc8
SHA512d5a8d90318d8e1fbb2739bb911fb0a28a5b81a4c9b7cf7f485cf05fb7f7d7b968d1237c468de5ac914f63bfc805f59fa44940a9644fc17572a91426322c23bea
-
Filesize
5.2MB
MD5c082a29b5387c58fbfe4e5b16429da00
SHA131f7ff537f47f86481461241c62a04994febf99a
SHA2562a545474300ebafc42705e365f32c0220a0ef87ef59fd6fdfabd9068ceff1123
SHA512fc4fded4f5419c5d3530d490ad29e66f886b1d82ec0c853e87862dc65290f41c6deea051e9145f7edd856f16aaa3002c0a467666cd62e4b8d9891fa488c00c6a
-
Filesize
5.2MB
MD5ead481623369ec41e3ffc875e1421738
SHA1599f35d394e26fa6a91d13e7db15d4ae13f492ef
SHA256b4b9832c93a1bff566dbe62d4e054e8f44bb708425fd23f02a75f4717b052b41
SHA5121420a2d0c3b3e9a0516c2c09b0cf68ec8657358ac87ab964d5227267589e02ca434158ff80f353c9153502fad907f7deeedc42706516ee8fc7b6077c69795724
-
Filesize
5.2MB
MD5950fb9905e14ca0f0a71d7c7dec68793
SHA1e74ae4160adcf08a9d3663ff4f0b4d334c284e50
SHA2563fe4704e5f5062479e3ce16e22b5bec8e1a2b0aa4a09938e96bbf4fc3f880c1d
SHA51200e04aea2f1a3ad185e99cadf30e0c632e3e7d1077555e09be7008ebbf82cb910fee611be1821f3906496e39730ad74d11f875a186c693b9c4e1073e089f5c47
-
Filesize
5.2MB
MD5fea3c452111963259f4662a9a4b5a289
SHA1afa3525f1f4e7f6ccae7f37308b2b8b6c5f5d3ea
SHA256d5abb8e76beb6a1f8d3dfe78fc11d09be42ec24c7d1ab5158f45956ad3b8be2b
SHA512964f4494a9a3c00f55423f9d44146de8b7c246e72456ef4eb92368a5b5d318fe2fa54d76fd8b2f4042a7af40a2694d71d8abe907af4ba595e775c9c76255ff59
-
Filesize
5.2MB
MD54e595381b49a991d3ec70f1de27c9756
SHA1a7c0a8d94afd558ff9f1781cc0ee931961d29e51
SHA25668d3a5a2910366e09a42b11d37ea7b81b5afb0e8def9b4fcb4fbccdc84761a1c
SHA51299369d4592b4e39d0cfcfcb102b5f1908b9f9b055e4f3e90d770a1e149646073b77e1efd51577b5bde598d532440b414a248f464bc7bedb91425c4526013656f
-
Filesize
5.2MB
MD50d5682bde52ac521554cc95e77caf6a7
SHA187841674c8d92407fba7bf4db60041fcfaa8f13a
SHA2569cd42a59103ea31d184137195c184a4945e2225d4415b71ae37398c4cf570460
SHA512eddfe7f1776c7524552e3ea5ce8a9552bb25ec2ecf7d0a6848164779e97b7a0d569aa3d95c8b239fd5b89bab30ede00f6f7361c423719e48786b781db234e5b5
-
Filesize
5.2MB
MD51bf05feec875b027f0946745311c7e8a
SHA1db0644cb461396f24957e32a3aebcc8545e04b6a
SHA256585079dbe8b938442ac02fb0d892e88919be5785a5a205a66de82082b2736834
SHA512b37726519ac90b910ebb3848d24f30085f7b95efb6d3fd781c9b29e1255ef21bb752919a8c90807fa258e28049d60d29dede13173fa7cf65ba44e8256feccb41
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB