Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
19-05-2024 06:44
General
-
Target
2024-05-19_423e8be66a70ec611f5233e5bcf531c1_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
423e8be66a70ec611f5233e5bcf531c1
-
SHA1
e2030f67d37a244f544a657af96950105333f6c3
-
SHA256
b98d6099311feae518894f2f6f95c1a7bbe2d609d2c6d3f182b15282a6737786
-
SHA512
b777ae8df6f91aacbe127c6e7298f9876c0927cc0478f5bd0ecfbfd6a1197924003c6edea1fe9f75f173a42d7479d2e401c8f022c65924a3d23bf97e0597de5b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-19_423e8be66a70ec611f5233e5bcf531c1_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-19_423e8be66a70ec611f5233e5bcf531c1_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kxBYIzH.exeC:\Windows\System\kxBYIzH.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\oxYiZVD.exeC:\Windows\System\oxYiZVD.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\mQZPycA.exeC:\Windows\System\mQZPycA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IzPBzyr.exeC:\Windows\System\IzPBzyr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rzZgapV.exeC:\Windows\System\rzZgapV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OWNbHjV.exeC:\Windows\System\OWNbHjV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RiUlfIV.exeC:\Windows\System\RiUlfIV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PTUJqAN.exeC:\Windows\System\PTUJqAN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rylOGyO.exeC:\Windows\System\rylOGyO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ERlBNcg.exeC:\Windows\System\ERlBNcg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BRqKSoy.exeC:\Windows\System\BRqKSoy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BRVTXiL.exeC:\Windows\System\BRVTXiL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cDIPFPK.exeC:\Windows\System\cDIPFPK.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HDWiEzN.exeC:\Windows\System\HDWiEzN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\Mskqaji.exeC:\Windows\System\Mskqaji.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yFzOuRC.exeC:\Windows\System\yFzOuRC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TlAFfGh.exeC:\Windows\System\TlAFfGh.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KYXWzMZ.exeC:\Windows\System\KYXWzMZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hYKZqeg.exeC:\Windows\System\hYKZqeg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\vJsEgOa.exeC:\Windows\System\vJsEgOa.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VLNmRek.exeC:\Windows\System\VLNmRek.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50290bfe3c761658f15c03c51acca1b2b
SHA12f029446fb79b8278489717f4d0be3fea9256793
SHA25676d2566b3c52b029e84ddec79ae801603652e1db2c78c053aa00b803e35d25f8
SHA5122c89b25ae01ea0e10f1e4cf66ef5f2d71574d9ad2eed88e2aa301ec4967839de455af015dfb97b597345f5a637f81c1a9ecb803000cc84df39dafb17763f5e81
-
Filesize
5.2MB
MD5a3fefcfdc0a1c33d979559020c46e59a
SHA10ed4565114e70b503b9934c71f71d745e264e6e0
SHA25654c8a633e6c286e31132b8eaa2aa4a6362eddbfb83df7c1891c28ee69190e970
SHA512b8ba786f7d3381cdd7a3f91f1f4ff19948abc02b89f075c47c177fe89e955c41412fb6064ace9bf0cb5c912be72e171dd743dbe76a6781233a8a5c17046f2db4
-
Filesize
5.2MB
MD51c8d3e7ce7081ac0da1ef70837ebc426
SHA1e251fdbaf85ace333f4d626a74eb305255d37f22
SHA256eef6193e2ddd5f8040e32e22a17cd7d82bf7958c6c428599cf8498cd74a2d683
SHA512207ed3c35cbbf58c42a6985c72d1d6b9a4c0ab67b0f7fe901ea5536f151b4e7425f47cc3a151d49fb6e01e43301a5aa32b10df2c3e4a1fefe145e97c82ed879c
-
Filesize
5.2MB
MD5f3622578d153743ba6ab54037e276730
SHA1ea929d7e1706783f0e4526bb5a79b0771f645fb3
SHA256120d52b6172ea6d37f86a8279345afe782cfbe654793bf38d17bce08e56f8b6a
SHA512582b850f0e24b1a3a12c393115bdc227e6511e64b59858c9a943d51d20687b814bb6620e5b0b86a733dc363f2e0b0334539fd4a774c79ad0838688a8638f2a5e
-
Filesize
5.2MB
MD5460f9e6fddea21bf5af37016c2708496
SHA1d79537e1ef97f5e56c8ab1bea1d7bcbb656f9a3e
SHA256015553b3bf6056a9c4f4e613a61dfc7a3f1e4f0962d516d3f79f04cdd11e0f73
SHA51209e8552d28ace9b28ad7e9de365e2be53734513fe80d14500dfa6d5d8454a26a857399bf18c287d701d8d61fdea70d6c9e07914ef7f53a912ce8fe9302f2d6aa
-
Filesize
5.2MB
MD52c55414cc4250d234a002316f587d7bc
SHA1c082e687eaee6e0ad4dfcee51aa39a22da62a2e3
SHA256dbf98f0bff8ff80ac45be43622783521e3eff9e073a4d47136d78081eb6674b8
SHA51294c9deec611ed5713b48d4687862d322dcf43bd1415ad23598ec1364697d13ae2bdbe9c94d77f0bd30a380945c119c5e2a5086687d429dc2a1f5e2760636aa76
-
Filesize
5.2MB
MD5cf4063ca4e13cfca2ded26922654d1cb
SHA10cd68d85f41c9914f720192f15a6499d9ce97d23
SHA25680ae9cf07aebc58b6b39ba6730d5692dd20cf4beac605669236e3235857bfbe2
SHA512f47f2e1387abe7fe4660f25873030e0373f55fa3ac4b2b63c475d9540231b892e77229bbef484084d4dc60b23d60f0612da58eab07f0714fd28d16f172153b69
-
Filesize
5.2MB
MD56b92b949bf08bd2ddc2a5f9d1767df66
SHA195f80b0888d132d287870fbf6236bc41f2a8d777
SHA2568ee8fe5361177541c23e7a85cb2c41d332adcdbfdfad0a1cc04531ee03731a23
SHA512f5aebf1ebbc8e8e2915cca0544198062191eaead05b9b33253900f3964be25124786cb77cd878c8628873157d89e6f6317bdc6629dc2bc42168935384266871e
-
Filesize
5.2MB
MD56a315737c3a9a42017b615d094b3a923
SHA11538050aacec0440bbfa914d5822760263fbfdd6
SHA2567f68d37229b199100e6937e236674db955fe9e9fe0adf26cf693be4f8b54aa19
SHA512fe9070daf729c5fbb586a64ad73e02eda15f34bb4b0d9e835d13b7eb7521f061922d7ef33350041588dcd02abadeb4b7941f3205702ef0785d500630dac6fed6
-
Filesize
5.2MB
MD5f5de3abf8b8ff9bb3725561e2e956990
SHA176cb3cb4ab4620c8ae16125a60b986a09de8db89
SHA256f067cbce16156220dfe4c6f6994b90fc73650b15c9fe01408d2c07986633753e
SHA512ac685bf495fa1d9e4a391a552e168a13a26dac28ab18cbba334ec13a39e5413b516473784303a1b2b9c6b0122d1c3b2fefc8489bf84bfc7dee6bd99dc009484b
-
Filesize
5.2MB
MD524d23f42d7caf9c57ca74112349f5557
SHA10f844eb0fd6a855827a04e6334e07a1beff097a6
SHA2563b19b0e38169a23817645ffdc4a5a586003aa1698cc2d22bc3b12ed162fdca14
SHA512af45010441e0085c30cd26475b2b491ae0ade1581d918e599c9abfce5f30ca92cc95a5a47b728ca1331d612a5a98c3a69206d52060b2784d7f5449d3ba500b78
-
Filesize
5.2MB
MD5b567270c7a427b894b7e6fcf8e5a89d1
SHA1c204613572a8090d516c8d68b7955e36cff6ee12
SHA2567f9d00eff1cd043570a19fdfe75cdcbae12816245ea64d465eded6e41f524d50
SHA512b11b0e8c2a028d5821f877ddedfdb1eaef39cc5a2fd20f90d81a1764a5dbda211b4450283c747fb1fc29090b9c3d70a71731541b4c452ce757266b0f60095676
-
Filesize
5.2MB
MD54919aec53b240f7f51f3ce2b9f28bc16
SHA1c75495c2a70ac16e8002a434119bb1ce7cda4816
SHA25603afa92812e11b4c90e6de15adda97d059916d7f76358196c12d3f60f587344e
SHA5123cc6b207f97ac983c6c3e8621cf7e4395b0b6614adc32187a1ff4271b28f78c2f4b29981e9cb96367e50ef5fca16ae46cb7674386f107fedf166f1044b58d4d6
-
Filesize
5.2MB
MD5d2d846a7773ebbe23f5404a1ee52fc9b
SHA101a3cd1713fd55a84d7e6ec0c3c481c2bc27d7fd
SHA256377ff5eb4fe390ae9918c63366de9725a0e7c589a847890631e18724cd91837f
SHA512860dedab63ffeaaca119614de7ebcfea02f6a0e236a9417d93e3c6a27ff50fd73e7be17fe135f6edb57a6a6c2976215f549bb250d0fec0991d8b7ba2f46898ae
-
Filesize
5.2MB
MD5e65af60273f048430dc16d4230279c86
SHA153ea22a3c9985ddf426512e2ef2899e183341de2
SHA256dae864df7ae16d2913923e6c65558d072fef8659d16068ac0ed4bb6764a2c9dd
SHA5122d42d1ccb1d2688f74b54c78ff179400d4e34bd8d00f28428878fd2b8e54044acb4c036cec45d3a11c8df874a656e76badc9f4c348632c26de800ba603c25276
-
Filesize
5.2MB
MD5cb57418225ff1a99ad90e58ba16078e5
SHA1556ee4f0658d32f46ac7bfc02f9940c3ae57745e
SHA256de3fb1dcd3682e2499a6d0cce7fc46b90a2d2a8556a2a49028de95ef18cae4b7
SHA5123de1ad1022b054f5786a5f2ff12bc2f444345ad26d4a3891e9ff48309e9771c82e704f9f479f803367f637aca9693ad9dd69e1e31db8ea680e139786bb690274
-
Filesize
5.2MB
MD50d89cb39d579d7485afcf74ac1f2fd59
SHA1803fbcf1f885fb2a1947fc1bd2ba12f653b9d88b
SHA25618c8fd4806719e2bc08da873cb75f2ce5ef643ac56ff5904f71a62a2a9a7cfc4
SHA512d3e8366fc6092c97d487d4abc185efc29402f42b92bd07769494186ec5ec186d9bf7e55ab3d7b7ee11fbe33922d6018ba7c9726518fe6218c32139b1dfefd345
-
Filesize
5.2MB
MD547bf24ef1f34b68c0a55e1585a307247
SHA1a96e3bac44d3f1e54bb01bc1a0b5d78222ee3911
SHA2569b3d0bc9a2e119ee86607065926bcb071bf165e81a0843b13c1c106572e6e642
SHA512a5e16c705e7d8020746b571fd607f17af4302b5b1c43ab2cad90d7b3c62fe152ca8bfde99ec7cc2e64842530640ea9e7862c03179b734da348a6de50dc506603
-
Filesize
5.2MB
MD510c357d1de71199acaacf08676ae8405
SHA1a021343c3c9cc6e7f5c0517550a2bcd606a8cfe4
SHA2561b96c36841f0530d4ff70cf4d305070814518be06a82e33c9d8595ea0e488b25
SHA5122e8cc7be7e954e13ac8b400c2f8a84d0ca334bb6a481ec7173f439ec88cec9f973717362b9d84aeee794dc68b62071480b18730d6e50a433e915525bb1f19d27
-
Filesize
5.2MB
MD591c3d26b98fadf8cf7d47988162d7a2d
SHA119c48c812680a0eb237004fa12502c4a194a8c31
SHA2563e49f549d8a31f42edd83dc4c64c0714a3c24f969cd9ad2a8e6929ea5b153dfc
SHA5129a4bf448663134df8a8ade30908db2b47640b2ec3e1ed8012a6987a3886388d881aebad0d377c6658798df5bb5dab7bf9803fd51b143640563086f616ed7b032
-
Filesize
5.2MB
MD5c43f2b969dbcb11537064be3932e6a9a
SHA171d1b8c8967399be5ec98bae8b82b3b32dbc3b81
SHA256b1820bce4e4017bd854e6531452293c01d0867da1410e65df5bde217253d869c
SHA5120111e1e14cfde95f0ea8c60909473461154aea9b3d3c3f3d3b6c428118b4051895ffad9995d0b62b5bf45a0d5e042f947e81f957eb078e221e3d42dcdf472fef
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB