Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
31-03-2024 03:47
General
-
Target
2024-03-31_493e5f16ae4963318897783ba98e535c_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
493e5f16ae4963318897783ba98e535c
-
SHA1
0ca00c7ccfdc4c8454cb931689b68001a1776aad
-
SHA256
b280ce8371fe4f3667da2c3fb29b7e71ff944330ce4e3547bd3b0eb3bc010f35
-
SHA512
70c79c9b2b3b6aedba10bb3afce5260bc74b0a2286ffb8fff08de466d6058965d71eef431b32a9fec4e3a6bba770a0ef61ab9e3ac2433bee6ad148d33cf9a238
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-31_493e5f16ae4963318897783ba98e535c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-31_493e5f16ae4963318897783ba98e535c_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EAwYVeY.exeC:\Windows\System\EAwYVeY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYOPWsL.exeC:\Windows\System\iYOPWsL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mFCfncu.exeC:\Windows\System\mFCfncu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UWovdTm.exeC:\Windows\System\UWovdTm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSDwuyl.exeC:\Windows\System\uSDwuyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MwxcfMI.exeC:\Windows\System\MwxcfMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHyigxd.exeC:\Windows\System\IHyigxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPXNnXK.exeC:\Windows\System\IPXNnXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXpctuU.exeC:\Windows\System\zXpctuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqHpvRU.exeC:\Windows\System\eqHpvRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUOnUHE.exeC:\Windows\System\QUOnUHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jIweXlN.exeC:\Windows\System\jIweXlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVkOuRu.exeC:\Windows\System\WVkOuRu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ynHXoxZ.exeC:\Windows\System\ynHXoxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSlPCub.exeC:\Windows\System\GSlPCub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxhUmoo.exeC:\Windows\System\CxhUmoo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjMPaWu.exeC:\Windows\System\UjMPaWu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jaTwyWt.exeC:\Windows\System\jaTwyWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urEWMjf.exeC:\Windows\System\urEWMjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zskgVjf.exeC:\Windows\System\zskgVjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RMLceiw.exeC:\Windows\System\RMLceiw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5bab88970155744e39008fb5c901eeb42
SHA18c4a0e36a35f9c54cb50e4b171781af909e00cc8
SHA2565dba7c3b2ebfc215aab383faba78b35148ccb83ff2057962a1b6eb7ca2e4e1aa
SHA51222310f9e058d58c795e876845e421692d7f551338319e6cf4e593536cbf918de6846ed5220dd86710b6543153b6e18c566584d9341d33e8b118e5c02a2bc6b25
-
Filesize
5.2MB
MD53ea0b5ee5807a47425ceb8a16ecf8b8e
SHA1fecd01815740e5edf4b35d75dd62c19273254ae1
SHA25640b117c1f21450617462f6398dbc94d3848d221666270d6e8a2f1cbbce158ddc
SHA512bdacd12c9d40e14830974f1698544b0b2835224a78518d29d7c7fadbc491ea21a4a7765b32e90f509629952cf92127eaf1a299174c85d32c262a6eb65c7b5c48
-
Filesize
5.2MB
MD51754f737a8f073f043214471003daa3e
SHA1328bca958a80b711d5acce5755d8a38de17b7939
SHA2560474875b6f0619024169b43c08307a62ebda16d4f55aec96681dd926df3957fc
SHA5125d912a006e026868564db253adbd3244faa96b8dc456927ba8ef04fde80e6879fb80afe8dd95778ee6ac8c38955b80dd9e792004d512f9ab0d10d3e78a5d3a96
-
Filesize
5.2MB
MD5a1b847c0a09863fc678ff39195dda9a1
SHA1fa38d35b20a1abc81533448a09d630cc32859344
SHA256a75181f8b6df0f42507cb9f8f935e9fe4e01b2fa8d9bead07574f330d854a632
SHA5129082459b9438cac78092baec98d7d3cb20081f8a91bb5b36d06dcf8f5463ef6d95543cf7f96d4999b864f1ae4a62c0c6aaa66fed246395b3c06edcf3430ba7eb
-
Filesize
5.2MB
MD5c443bf348f8a281feadcf3dcbc2ffcea
SHA1806a134fb310a57d8375e8f8d9a978da9156840e
SHA256a41ea3f522bdfb2a7c0b5bb6c86c27b72ded79883f108efe899631c08f827685
SHA5122dc736095526392b62e842155da058419e1f8ab06ed763feffc330fbf2ea66ba41a1c505b76b96e39d5bde191dbd6f0e86bc05b8ca4714ec1580ba2570797167
-
Filesize
5.2MB
MD5556aaf30a549fae40db4b5e4f925294c
SHA1d53dacdbe5b7609f58186aae7df82532d4aa3e6c
SHA2562abc916c7f54d533e6b9b127e5407f65d54a912b91f39247582efaade371c5ad
SHA512fa3532f1680be05c73df449e9b958d6edfd2c210aa08285b63559762f3bb3a58a229ba7d75ffdc8822545998d717d40178b42b7784c1830de691628fb3f3f4de
-
Filesize
5.2MB
MD5de66e93747aaed637c1edb088d9a8f8d
SHA10880e3a004a242d532e300655ed2abfd0e555aa6
SHA256e5afad3fe45ae1ef90c6ee05e632aa0c4bd92378a41fb9979bd5a390bcd3f44b
SHA51213e49305cc4a953a425df71cddf5128e70efd8484da47d20f0efcbfdeda5047f31741f98aa9674359ca53d458c60d5d91c2b6f44f07b1573450abd7748d1c53b
-
Filesize
5.2MB
MD557b3beb7b78630b238a533b92e9489cc
SHA124bffbfe31794ee767bf352f78a053fbf6c1563f
SHA256300bc1e49275626e7c526ccd1a1faecabf1eb9a730c400a1b1bddd8938cd99f4
SHA51256e20b3fa75f7ca85184d1f5195fb54e5b629db8e3c18b6f3189452e6c677849bd4f01c46269558d117de0b9d54822198e97f0a1077fa2d554f9e6e4fedacd2a
-
Filesize
5.2MB
MD5cdddf0e73b3adba7ba1950ecd2c92e03
SHA1ae026d41ea76b7d86ce98aef05d286298ee7b9ba
SHA256b5cf7d6dc4c59cb5599dcde41146aaef9cfc7903225add8d5a372cbd0651922e
SHA51205b6c817a414292c3ab0b4095ba824b89480b9656d25724546a6ad7a099e54600aff16a3e66a14ca4645e4c88e99294470a1b79dd4300e63c85bed6fe94b52a5
-
Filesize
5.2MB
MD5f73d0635d92c60320a5c06c122327e59
SHA11f13ce00074ebfaa89694cbf96c4d5997872b52c
SHA2563a706c30eb4fcb180f285c1242a75a64c702c8011bf9fd69ab322c79e0560192
SHA51245cffa5c81842c004d2c4e3082266088338eebbcb836c2a164390ccc32011664fdf752fb3bcbe8cb0a3bf0becb09d028de529f3eea6f30428a8dd47b6989074f
-
Filesize
5.2MB
MD52837ea7c2f91326a37c24e3d40f23621
SHA12762c9ca57fbe6a0f9c976c086c0c19050948ad5
SHA256306db23729b4e36d0e717ecc0be6d3246194c45a21e4ad66836d5053d683bbea
SHA512df5a40e0d61b71c465b839e6093e9f7ceccf4b9f5b0e6bf458a60a8d6548b5ac379a73f6100f7de46740681705dac98d053819fd227214ad54c507a5341a8d9e
-
Filesize
5.2MB
MD54443f7b38f5b55d3f10b0e98658d6cab
SHA1eee0a2a672f5dad54f1afc6ed1ee67752d99efed
SHA256be3fa2aabcea2c3d8790434d6d23889bccf3ca35a6701f8c346802dc486423c9
SHA512dc36814c090026782c149dff8ac84c4bb5970af9da974dc8801019ee655ea8766161088c511f2c1e3d6564d45290f1604255ff81ef3fa991ee7efa14b9242ed5
-
Filesize
5.2MB
MD599686075d8fe5fbca6b301cc94778761
SHA10505bf93e505b1b4e40b4c80200b43834ac85d82
SHA256f6182f000b165f7ae68644f21a2024c25865e636cf0153cd6664de33e59ed4e8
SHA51253d096ae36604481276722fec266bf46f38c2a52fe4d0f26de4d0d50661a3654368d5c5410ce90af2d0d63111e10da7ecc4afdb20487e0c0ceccb5757c0ab52e
-
Filesize
5.2MB
MD59de2b2840efbaaa307f6d7dafd0000ab
SHA1146c0b7c9ef7e516931a71d6815b965d5666d3c0
SHA256579c3367c898db9f57bf3eb26340c7a07b5cb6f84760f3ab140967f9813b7245
SHA512cc851a586d7d56de4b95b327f2194e7d981bc945c2e210350e5970de6c8bb6f9f98c7fe472d6c4f7930654e54008bfa6cc27553d56c6934498ba814b15dd2739
-
Filesize
5.2MB
MD5e6b523bd7d2c15d817af52cd4d7e18db
SHA14622dd47e6c81e69e006f8bd87d7267466b5d4d7
SHA2567605eafe0a2b47dd47df7565d0e1d85d7dc9289f9098884cb531f7a34494ea17
SHA512058e7a1650132e2476c0c31009175573872b4c63504e230381857ee68a8fc68b26232d59ec910c40b96f017e7d0b3d3922d8ff02aa05d0387d385dcc406c62a2
-
Filesize
5.2MB
MD557079cec063f75b970264ed9d26fc868
SHA190dc07a74ac158da6db86f7d88dd0ca766a63868
SHA256a812e9cc4b260b4a5766822a5b03302a8cb0b3a5cc7034edc71927bd46784f76
SHA5127f0a013049c44d42b428b024ab21a691019e43106381e01e512b6d38dbbecb922c0a7362186e59db465f13ec03caf49b8aca21700d4f85a997bafa5002c9b5c6
-
Filesize
5.2MB
MD533d8abcd289df119ddc18b96eae4bb68
SHA13efaa1ea0c09584840507aab0c4a5d714033c7b6
SHA25677153aa969d34c7eb22bbda1b3b429efbc4c72c0d3a065a2af39be8425a32f1d
SHA512bd073acde32ceedbcb0184f3233f0743f3e81ba7582795d8623311bf4948790e7a8c2ae8503060c587afb9ef514c9341592231972504ddd9b5e9ba4f07177689
-
Filesize
5.2MB
MD5834fd0eb67adfa0c238f29cdb95762cf
SHA10e661e9da95198f60307b81f7d855ff0b09474a9
SHA2567818bb5259ce09317aeefc35f6861dbbc01467fbc334505743ddeee581ea3089
SHA512a248b0fd4971e2bd65a706a236c61892e40ca415874b48421762c79f3564f9bce68a461e6040e912f5f3f8df4747a5736a96e6a223e709923d9ca3ba0d599fe0
-
Filesize
5.2MB
MD57cb051cbbed105234ff5b62b82db037a
SHA10fe04e34b442a5efafa121386107e521be945833
SHA2560cd8f9e79a110c2a5a5eeea516279ad402235c57c90a90e056cd972bfb98de32
SHA512ebb1bc109ee24f68c8b36d992257a1e8592f5eb5f5a493494a53fa6d577b2f6dfad9f9d320f95afa1ad261afa49cfcf0779858dd5c079b23273f302116a4a03e
-
Filesize
5.2MB
MD5ea1b45542cea03412c06dca9ce4baae9
SHA1761e13d213439b944f0304d174bf94eaf11be6cf
SHA256be469d6c3f36e37bd66061825eaff7d06b5b68b00c6cf0cecabf223c5d5b2bef
SHA512f9fc6172d984d3c84565fab93b6201fcc2a941e616a9c7650a990ecbc3568effb203790b34dd585ac948ea96754e1debeb6e31069bb9eda839c8cd3398b0b0ee
-
Filesize
5.2MB
MD542f17357c25b2f534898afddb784ffbd
SHA1adeb8d18b12eb79dc0fbfcf5e4b8e622131d4f60
SHA256b345972f40e8a479783c9501664e9c40d31958149a5b6f739f04b789e0484b90
SHA51277cbb54f02876f491a8fede242fbdc87d4b0ea49a64001d1ee80923df3516c8d1a05755286b6efeb1771da022cdeea22a587854fcac88b57ca4a4939a7fcb026
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB