Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
16-05-2024 12:41
General
-
Target
2024-05-16_8f9b2667c220da187dcf68cc45163cd6_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
8f9b2667c220da187dcf68cc45163cd6
-
SHA1
f5d160f373aed69935ecf09e986420b9fd2d9e8d
-
SHA256
c1c02a553f2c33230fac193272d056252f3d2038b48a1f12ed5c076b9f506f8e
-
SHA512
d31c6749a2eb80c46c581ea48c2c28ac7c5baf8e9157edc4b23f2fe410b9c465fc36182a77298e66438392b5fc47f94e940e2f39b9007e6914a7a487931c4dbd
-
SSDEEP
98304:demTLkNdfE0pZ3r56utgpPFotBER/mQ32lU4:E+K56utgpPF8u/74
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 56 IoCs
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_8f9b2667c220da187dcf68cc45163cd6_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_8f9b2667c220da187dcf68cc45163cd6_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UNcqUIr.exeC:\Windows\System\UNcqUIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhbVxZZ.exeC:\Windows\System\ZhbVxZZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\scWAhKx.exeC:\Windows\System\scWAhKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUNzltU.exeC:\Windows\System\BUNzltU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUkHDJL.exeC:\Windows\System\PUkHDJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqYmfEK.exeC:\Windows\System\AqYmfEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdjgVvx.exeC:\Windows\System\cdjgVvx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FQMHvqq.exeC:\Windows\System\FQMHvqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHEXDuP.exeC:\Windows\System\AHEXDuP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\updyVXz.exeC:\Windows\System\updyVXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbmCARu.exeC:\Windows\System\qbmCARu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TdbYCqJ.exeC:\Windows\System\TdbYCqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WkROOlL.exeC:\Windows\System\WkROOlL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzkUbQW.exeC:\Windows\System\bzkUbQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SvdbZPt.exeC:\Windows\System\SvdbZPt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XiWMHVH.exeC:\Windows\System\XiWMHVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwuPrwb.exeC:\Windows\System\CwuPrwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYXAyEc.exeC:\Windows\System\CYXAyEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TeUSndO.exeC:\Windows\System\TeUSndO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yghxdOp.exeC:\Windows\System\yghxdOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbNvpLv.exeC:\Windows\System\BbNvpLv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD583d2512c5a0f20c52474e7af051e7b29
SHA1784711262ef112eeaffe83730af84d0c5e97c9e7
SHA25625c78dd5c6ae8a126e7523487c102d582678281130c884f0db98613e47ee97b9
SHA512b1fbcde829cc37016d993cc83456b540664b646bc72565459d29593b0cbf07d17bf7ffc7e9811550a54c7ff4783271aa3e390ffe4645d106cf4e37e65ac4141a
-
Filesize
5.9MB
MD52e3a3c14c6b6a85c2a96e4a79b7ee0fd
SHA1a47204aef7174855038058f370696f1f58a46457
SHA256673bef70140cce3cbe66650be4023b19f9dfd69194d2d04115688426fca52b26
SHA512b71e3a2882043756eab5d33de5d6ba0d5daa4b0b07230ea52e2db822e4ac481524da942709b914b3c90dcda9175b54d6310e248925a163ae983a46e82a59c2f3
-
Filesize
5.9MB
MD5cedfe0b68b198a20e10c3f9572eb46a3
SHA1b1d0253ad130e2ed748c71893d567e9be674c0b0
SHA2563802d0cabc54b2577b4292e6e87407f72a7a5cce277084b3d0c5a0ef21bdf7e6
SHA5127f61424452c27f42512994f7cf6631e2ddba88dd5d31bb3e20a8005868e4ffc2c4db434a904101949d57268160d2b508df1da1482139c72a36741c4b0b09d888
-
Filesize
5.9MB
MD5fa18dc009376ccfed820fc97f8f67baf
SHA11a40255c609a224fec347ceb98733353fe9f27e6
SHA256d1fb9cf5c9fd80c53f856268bf22fffb8e1fb1696efe94dac8f2be9f58fb1ad0
SHA51238354d81a740ad983a2ec71e7d93bb5dd056fd2904b6727c562d5e94d0f6a86a56eadd2cba7543d02ec27d3728efea8d0b5fadfd52af332086590e0f741a8543
-
Filesize
5.9MB
MD5fe6f558ab48166c065fddf6fd3060813
SHA1552ef500c9cc1339c8b5662da5cd4bc9656840bd
SHA25603b4e7f49aeeed7ecab2b70276af8e657cce063cd9143a415f45ed2e674e5f1c
SHA5123b4977d8dffb1dc5f1d3041aa3df88eae6904bc2254b78e6c1795ca068647a8f5a646ac405548042397c6645ede851a281c4f84faaac1626a3a2cfc03b88b13f
-
Filesize
5.9MB
MD552c914435948ae9699fd8475059adb67
SHA152510278ca022d9e99e7e9c421efc1116e65f6e8
SHA25604b59f163e4679019294641fbedc72a765baf785c914a64dcb660f2b8068db94
SHA512dfc239b6b4ba4fd33904f12aa4f6dd7dc4bab45eef2ed10ef4caa8ce085ca3324f5d1107514b0bf92fa433d83c9227c739ad11c57bcb2c603be34e03b71f7beb
-
Filesize
5.9MB
MD5af9b970b2fb8ef20c7be51d8ccdfd97e
SHA1d1618ad73f26c6e3fe85875a5135be0d8cf2a759
SHA256bab58c7d4c6abdba4989f1c1c602959d5fb878df2b85e0b0bc3c2319e68b64f1
SHA512fbae189c1d6b889a08f42052c1bede6f744657621ba8e69790a1453ad47deea3de3e98ad203a54222ad5b0ea19ae4e9c954dd6e2fd340e3c0f9c395970038c3c
-
Filesize
5.9MB
MD563e0cb97940de4ba6bfcfb2fb4c01ed4
SHA14b60a36e26b38f7fd76619ca164b6d57edd15101
SHA256b8d50b891e668eb6d79074a396b15b6b2f8087a4064083dcc913c21b233a93a4
SHA5127535538aa16b1c875edd401509c786e655522ae09adaa306927454c56f9ab37ed0c43996a931bc69df4be8e8bb2fd10cf0c3296fd52b9f9bb1abc9e0b29a51cf
-
Filesize
5.9MB
MD5e7b941608c76170f77ca9f4fe378b71b
SHA1b314e8aa6312c82e010d5a607c3b5d1669e5dc67
SHA25602f6c2750ab375b1f622b3e1fe11540eb3e75cca670f1a8915ae8b02b889b024
SHA512fb9905e510eff02046a5325aed649d104204426bbeb668219191135290485bd57537aad57c3449089415b9ed024622f6b3f60583b6c636e44252d5763747bc42
-
Filesize
6.0MB
MD5cce675a6e8aeb3e9ea8ae530860190c3
SHA168f327f3914aec4572325e190ea32aacc952bc79
SHA256d4f00e9badcd892931fbd321e01d65d65d86f78aba3cbb616bb964f2e01d4ef5
SHA512ffb6c21c11c57b2b2d49aa4b297b06b2651cf138cd67bae94007ec1c42bb42907ee03a2024e4c1b25d065e27e751817cd6ac4ba4e4c60c0cd9858e2a304fb1f4
-
Filesize
5.9MB
MD5420cfdf1a2781bb3411873553673624a
SHA1c26ebf1883562cb1b44ef1150916de42b35969df
SHA2561d143767c83995488f5169d28e5351c91581678241d1607e9e0b40369fb8577c
SHA512c06a25a5893fe3b14c556db796af4bb897856bc476120081c3ab6d563ae280f6ba7a8a0c6c7225aa1ab4f69e3b533cb52ca6c855abc3e50e718a2257a29e06b5
-
Filesize
5.9MB
MD58adc88883a864f4dfbbcb22069691a3c
SHA19a525fe4a2a364b6474b329acaf5e4960d6da49f
SHA2566eab9137cdb91f3c508a00b052d53d4f3a0ff41b031ec5df88bb72268e6a3558
SHA5123ea16757b0e7656dc380e279a01cad48037af16553a75095fa311328ba392a00381cd2b2cec799b2553260a74d4fe3d6f9adf9edaed2ad4909fd71b25d34237a
-
Filesize
5.9MB
MD535ec42dc769ba5e63b44aa4befbc2efe
SHA18401520e459e97223db04bde95839616ca9f714b
SHA256aeb67d3561d9af648253b003239cc6c24932462e9390af73b8f05d9c206bf1f2
SHA5128a7696aa2ee3cacd5ac0f8ff5ae58579827a6d4074387ce05295bc7435751870dc0cfd364eac0df6016f24d768196a05db352a68f42d98678e72615711ae8840
-
Filesize
6.0MB
MD59dfad1430574bcd9021bfdb00befc6aa
SHA14ac09f02b1a9667fcb201699c3d65edf34fd8739
SHA25654349c86aa74610e5ca5ef41f6bed5d6f607ad8986629f4ce5e917372dd5a631
SHA51211362747c446f42a64e1718a99080a596236b587a8ef2c7b599b204697a915003b7126c6b9ee5bb2580f5ab40d0eb4baf97bdf67a081caf3aa6ef6448429ca1e
-
Filesize
5.9MB
MD5b71fbddfdbd24d8a5181c3bb5551a506
SHA1a3041e881ca09a3b237c15aca9d7724d9c671a01
SHA2564a69215b1b42f57d79bec72e6070609f64f58b8798b9b373dfc131b4dd1ad3b3
SHA512c7f8000d4069ad34d512549805c864ab19d2cd2d86e731e34b6e21f16c8aa7f624c51b3ff4c09f9ebde1d16d878532b33c08fd58cbb80d38f316190a4b997b48
-
Filesize
5.9MB
MD54a9458efece20cfbeba9da79e031e50d
SHA1fcf81ff21058b7d8ecd0861f6bea384bae763877
SHA256ba3967c25575cefd2e713d11cfe12cb95f10b2772bbf463fb95d6a1cf6cfa715
SHA5122b91fa21c75d53a4c65768b04adc5b6c86312c0aa065c2d014bbc410219b9762ab858362ae09cd4598bc73d3db4c389844646b14b3dd0ea0fa22d2d2f170561a
-
Filesize
5.9MB
MD5c4bcca289efc445059ef239f45af5c7a
SHA1c3c616e15be2d3f2f518583cad6b45caed8d7c6d
SHA256f1d8ecd81111d9cdd35085e732bbbc19e6e313dfd757a9693fa6a3a77af68f03
SHA51254fdd105d125215f34630670280de68c854123fb6e9c06a8e113b3c8faea01881d40302ddf1d72281e6a21c8d7aeb890af91f47834b2d2ed47a19f8b628c2d43
-
Filesize
5.9MB
MD5531b4ebae3ae2b5513e0d1c5135c66cc
SHA1ce1df1bc917db08fce3378bb70c878b883bec130
SHA25618894e1932c94e1027433a93d45dcfb0b2dff28b2fca8b6eac975f58df0a9a77
SHA512ee0c3ced4f7f84ec282de9c9eb2551323bb549c17da9bf942329929a55cb676ead120129c55695cf9a91f67da68aedd83fca84042f6231740b8640fa6d8eae0f
-
Filesize
5.9MB
MD51847996c6d4197bf04796aa8c06b1f51
SHA14819eb44b95fc38b08c22309b91cfc0c5532551f
SHA2566f9aa318776d7271f0cab8e395ac3e03b0163ddae02ca193a01bb765869fc014
SHA5121a501a9395fc3d757b5c17cfd2a282b3cf09aaae2df79d9307335ffbd61be91bfae39461e117e065f5a725cc849b77dabba40b156383179530149033de127742
-
Filesize
5.9MB
MD5a8d7844d85d4c1ecf9611463bdad77f5
SHA16fdff4db6e2b25b0465566ac93e25c52fc5bae98
SHA256486fd00c57068abe77d79b3fbc88e42d74a70bf2c2ca1400c23f497d62ff639b
SHA512ae14bf4033ecf2dffd992276ab03637e5e2b9bd3cfa53e363c7b9a228aa210bd645070dc7152ef53dbe1f86f3ab7fd20e3d44587c594ce70093e82be6a86cdab
-
Filesize
5.9MB
MD57b72f547930407506942f66baf6df0df
SHA17a62ea717f594cee60ffc41a8707c5cfa90b49e2
SHA25693fb8b25ca0fea798bf89e7206102ce9f4b21beda39861c7595c3b11eea88d43
SHA5122e2af3b99e68f3c149860dddc06229e001fb5f35a5e4dcc8670d34a684fc2b9eb0a1c65c2dd790d8e3aff2c592719d46e5a1d040bfd93997150666bde9260188
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB