Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
20-04-2024 07:56
General
-
Target
2024-04-20_5af509b12a42931dbb3a470a1184d1ed_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
5af509b12a42931dbb3a470a1184d1ed
-
SHA1
8bcef0a1c2bf59af44f06b1ad7b02f237d74fde1
-
SHA256
9d6244b114f9c3f39d73fc9f71c816ddfa17c5aaaca76ca4fbd3483766eb57a6
-
SHA512
1e6129500e92d5de1510804e375b5595083e9a74bd3a42da1e75933d6c0b308067d0d50f472132c59aca82385b953e25b09896a0b64875f8915a53defa79205c
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU7:E+b56utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_5af509b12a42931dbb3a470a1184d1ed_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_5af509b12a42931dbb3a470a1184d1ed_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GtKgNjs.exeC:\Windows\System\GtKgNjs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhkkZOc.exeC:\Windows\System\qhkkZOc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwnsVxC.exeC:\Windows\System\gwnsVxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pklkDjQ.exeC:\Windows\System\pklkDjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xfEsuSS.exeC:\Windows\System\xfEsuSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptXysWf.exeC:\Windows\System\ptXysWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpAdXEs.exeC:\Windows\System\fpAdXEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cZVSHJn.exeC:\Windows\System\cZVSHJn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGSJqyL.exeC:\Windows\System\oGSJqyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUuwdLT.exeC:\Windows\System\hUuwdLT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYZjVEK.exeC:\Windows\System\lYZjVEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGzAdVi.exeC:\Windows\System\JGzAdVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UILkDAa.exeC:\Windows\System\UILkDAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tIWvNsF.exeC:\Windows\System\tIWvNsF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOgLWtY.exeC:\Windows\System\BOgLWtY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wymrYCF.exeC:\Windows\System\wymrYCF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSzlrHW.exeC:\Windows\System\BSzlrHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqBDoUt.exeC:\Windows\System\AqBDoUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fqpjTcp.exeC:\Windows\System\fqpjTcp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DurjFyp.exeC:\Windows\System\DurjFyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sZIzcsO.exeC:\Windows\System\sZIzcsO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD592a479ff6d505fa1d7b14604f9fa1105
SHA1187f6a8fa7401b7ae2268c2954c8ceee20a16e01
SHA2567972ae52f2f7941f1a6469b6e51931b83abcc271d00c6e54aac3dbc681657031
SHA512cfe8b58c9e8bc4b02b8aac3262f4f86c0f2f890b7097162238d6eed6d3db2e27b15c282fb9de66945546e2bf461657452afbeafd098d5cd58e01f6c7673eeebf
-
Filesize
5.9MB
MD5014f58f3679a6ab18d8a0cd5d4ca13d5
SHA17cd277a117f786d3baa432185f421ae9d37dee51
SHA25604becbf33d2eb245184628c78324c06145daf3976479c41ef8341f1fa0f4f4a8
SHA512b797a0601ef995120761700fd6ea9306d6110bfb6eeb01a047c8a488627c1ac58cd7e69209c6e5343f2f7f570d72d77ba060f9a1973db150b97d0445bf3b5b13
-
Filesize
5.9MB
MD5f3b0a20ba57ae2cfca7710672e276eaa
SHA1d81d3e9f4b39d25cb61ac2daf03b0faf5752c3b1
SHA256e3b5414eb664ecb666976017c6aa6bc4af2a0ee4b9d9534aba7e5c2acaede57d
SHA51242f34a8e046e687a4fd3cec478f6448fac18de825460fc69d7f53660cfb54ea33f85f85b1336a60254e47a55214ac6fa8d83e38f10e02a5d76603ca2e34dcc65
-
Filesize
5.9MB
MD5427f1860c0643dfeb354f08630353c91
SHA1ae3c080eabce5cbc1393ff8de86f1b088e5e0a05
SHA2568a1b1e4ccce3c2a3a7b120e5cfe141c01638fa8a862875fabf6b9561b641fd6a
SHA5129c7c52aaa8cf86bd377934166576f9e92668cc0b8eac95e2ce444ebd340d959b2eabea4f26520f0a17eb900e2dc2f36de0a9d26ac67b957257a874e235fb05c9
-
Filesize
5.9MB
MD5a0343482d8cdd8c5827a9d37aa3c96b9
SHA1081222f12472a8ff6384ed6441e11103ca16a40f
SHA256274a2700f939e7124bcfbacfbd826839e278fa7a71d751ae69a4ae14d98934fc
SHA512e526102c4594ca373a3ae27cf71433d327d1f8216b34bf2a63513b33461015816e353a0ae5b68c7950905f616a024a2a1af7c9b55dfe2f063e94d49f5aab18a8
-
Filesize
5.9MB
MD54d06469474aa55820e5c701c3e838000
SHA10d6493a926b89acbccc1b37071ef7344bc8ef5cd
SHA256040862fb6816a07c84948e886986801fb0b793da97cd68b5901afcc58114ba00
SHA512a181719bb2e43b0ca1e9849263f8befd2e707d5a95bce9751ba236ef92b8a655d867d618f3a4e797261570f9510076ab5c4065712cb5d7ae8a7558a5010b6d43
-
Filesize
5.9MB
MD5195e2eb664edcf0c636574e9e3ccc8be
SHA15b634ce41611a181c13ea0db4fb738c1bded3b01
SHA25674f40858672dd6f74f13d9366bc1a465412853a22fc231c4685a4ca0398e4314
SHA51282162f98c2eba39814199075c1eb886525eb94d242da630b4de7e5316ff34c5f71b88f903f87b4932d28ffd068e465ac491c406bbb020b095f544af183c576d6
-
Filesize
5.9MB
MD555b1d40e383299c0b35f7cf8a159e622
SHA172208d20e2a9054cd66b4c2f5d5699bd9047b6ad
SHA2563f30bd3f5612279771d0df4fd9df561f926ed9de4753a5807c7f46ffb12e01a1
SHA51279f6dd02056901d7b4a45c3a844bd22dc50905916100402095704f62c515ae2eb883441acd9829148cd6c9dba86265176ebd9f476d353f47db544f1050554c1c
-
Filesize
5.9MB
MD582116671374feaea108ecd77d77ab78f
SHA1713963ca0b1736f5e707190f2d3232887e53ed1d
SHA256758f0590f2cc17a1c1f0134b450d8821af11c0a6dd505b2ba8cde3dbcd340616
SHA512fb1927029769aa6f54c8d74f501d61cb1acc2672b546b00524eac4e65a9631600763e9dfa9b3c32068ccf7da6e5fed208580e94a3361eed60c99edc9f4022789
-
Filesize
5.9MB
MD53ca88b4dcfb28d423e0d1a28e6315e35
SHA1b2262d67ec1261dd84081ee29b51fd0f69333350
SHA256003fe8415e353407ac55471fa84be853be6738a60af7013575a069c736a80569
SHA512353ac86bb0edaf5b25c9c161e2956bf7db20bef0781c09c8d436d362de498ad8624a0fd664dd3a07d2196aae6bc6fe0f1d61072f4885539b887408902e26ce47
-
Filesize
5.9MB
MD5e121163c520ed9433811bc0edc6377ed
SHA1e4d170997bc286f19e659419845087690429b4c2
SHA2560c8f57556022692f2d78b4569583d537fcd17ce0c7e6a990559c5e0c129ddc12
SHA512444a45a12e41194599668be3269cc76bc2eab092237d1c8b75d0e15afcb9febe6654647a2291a665d71e99e2e67bbfd518cbdbcf04e3ba3905e561cec3b807f5
-
Filesize
5.9MB
MD584d9eef1d1ae475f2143d4a0b58deb90
SHA138ab00d525ecfda792388a9592103133e7f83a41
SHA256b02dd883f598ce2903e375a16eeae5a08100b9d16c703cb38937569e8ec2e5bd
SHA512c4e40315975b5a698be2de3ec2d7d3440b7c6ce499e89d96c06408e4dae10e1d8455afd0e351d834f4a1ee34870a61f88ea466e988d94a608ff8da2050fb718e
-
Filesize
5.9MB
MD59ed811f0ea5113bb7954ccd557afd94b
SHA1a319a5ea97c0a4fe715599aeecdd5285e80aa9f6
SHA25664f38120765029bbe1a8ee64bc578083ff303412d120975b0d077a77d398693a
SHA5122ad4f41d8bdfc8b94a000f94a0204d7319d148b2b3bf3a47727a8a585946362834507adefff13619a902736bcacf6d9f8a54a03382188591728814a7429cdd92
-
Filesize
5.9MB
MD55de8594ba2373b5e00bfc9df601b3cc0
SHA11500ca4c2d9959e8d1104fe81da77c908b83199d
SHA256bceefa66cda74760cc4e2d1d32ade9761b847190401ee287d2228a95c9fc6c02
SHA5122c21a9d872768f1358e215cee988f89de8aade9dd14b05644ef515a52fb6eba82a012bd682029e02cb66f14028c5a2b0df234b79c4201fc9e245e62d086c6442
-
Filesize
5.9MB
MD5cb38dc65d7a376c4e70c82a4bc0c143d
SHA188b9cffeaa7dbaa1c33e4252f98f3185c40862a2
SHA2562ed59ceb1341d50c0ed7b958e3b49769c5b249fc0cefdf74d44d9b0c0359140c
SHA512b85c3010e4a6de898222749dbc4e9e5ab5013dd4ef994d05ad3b78fc4bac5117f5e053bdff3734d88454fe3bc3285d1c07638b5298ed9409c32e8f84d1c2c429
-
Filesize
5.9MB
MD5f03ed83e379fc5b62ecf0a177e92b82f
SHA17409f9133cdd1e0b720399be4cd9f3c905d914b3
SHA25621271c54b86a76ea283e3681ddc446447d32baa9563ffef4301dddc7636ebb3e
SHA512a86a14d6669c33e9b833334f1c1ed9f224ab6ce0cedf7914a64c7b42e85419412d42d58b3efafaff626df4f1427cd7ae82973e329c13970c82fc8c3d4d32bfc0
-
Filesize
5.9MB
MD596ede509eb808090536ef160ce9fcdd6
SHA1d9d2eca7066700eb35f9e743112c94016385320c
SHA256e95c95d9b2ae3d2ac1a61c8f96ca9d1bae87c063fe378b87f3413769b31d7dcb
SHA51279eca7e6bad28cf8887fe1956d2590ab32f5198712f14b0270c1bea67c8f240597ac74f24873d20f012aa31051653ff52d5dd269e203fcb7448c9fd37566e56f
-
Filesize
5.9MB
MD564db234b380f63aeed822feb7fbc1709
SHA11915699512d250298863a373df1d96999f054901
SHA256e683d25bc29cffd9cc4a690c1abd86cbc7e722869e84440f57b2bb15382d052f
SHA512609491268f2a885d77046550e7926f45d5a461a3ad0dde631832127e1cd7ad05f1a47f630c5f6b28c0ee8cf05d15bd239f25f0a3f136505a3021be07a4130487
-
Filesize
5.9MB
MD5e6d3fd28f335dcb12b82b72821de1853
SHA123cf59b967a0878c54c8036d75a2d97df2f5e1ad
SHA256a06a307a883a90087224a41126dcbfa472309c4fdb697b4ec13175fde417ff35
SHA512237ef4b6eb830ff2fc621307533ce106c4554393014a046c19cef18eb14c9f3154393b7c11e92f4b1a457cbc113cf40ffa2cba1921754af59ce91883902a2d8a
-
Filesize
5.9MB
MD50a42ab2aae3691b2f6bfc965bb366543
SHA10c4d03524de2f24c27333b2dbfe793c07546148d
SHA256e79c322311d351eaf2d6e24c8c98e39d348f02b0ea40773aa766def44225cfcb
SHA512ca5876458f23cc28ec4dc8af3088342616b3d30bbbe28ee4ee4d42ba1cfe4cf4f5b570a1df568ea1a3b1fd150649b725840da765045543fd5b52ce28c5aa9ad5
-
Filesize
5.9MB
MD5e85db852aafa8dd2d47e6029334e785b
SHA11b7815fd1fec3a138f3f52774a3dd1440c43ea46
SHA2566dd69fed94b3d3a6c3caf503718fc4bc46a85aeae96d288fcafd29e78e21b754
SHA51236441ba40f6b65db44f99bb8b65422b2807b9e939a332188e44af42cd95f5a4f980b992eb6a789c0a77bfba1fbf2e4e67b15574093c253812842cc4de55fc9d9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB