Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
20-05-2024 17:41
General
-
Target
2024-05-20_f841b0ad9eb5462e9ca1eb0a3149cbc7_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
f841b0ad9eb5462e9ca1eb0a3149cbc7
-
SHA1
514d0e8f419fe084180c49fcbd4239ce338a3844
-
SHA256
a9b48d62702ce0649694d108b0e09bec566805d928d73030acb6e64fc5a73032
-
SHA512
6556e95ff456a434bb804b041ae8dac50a34ef6c01660417bdb26a9666ee8e3b39185d4f1b37a67e53a5a8200cfbe38308b866cf2975e7b366e9800511572f0a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_f841b0ad9eb5462e9ca1eb0a3149cbc7_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_f841b0ad9eb5462e9ca1eb0a3149cbc7_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HXhDqUM.exeC:\Windows\System\HXhDqUM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sOcrqiv.exeC:\Windows\System\sOcrqiv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LGVURot.exeC:\Windows\System\LGVURot.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OHWvaiJ.exeC:\Windows\System\OHWvaiJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ZjzulCJ.exeC:\Windows\System\ZjzulCJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PrAjENG.exeC:\Windows\System\PrAjENG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BVqSSOM.exeC:\Windows\System\BVqSSOM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VbOzqfM.exeC:\Windows\System\VbOzqfM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TolnlCr.exeC:\Windows\System\TolnlCr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RdIsYUO.exeC:\Windows\System\RdIsYUO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nxJRYFn.exeC:\Windows\System\nxJRYFn.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QWarkcp.exeC:\Windows\System\QWarkcp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\fwEdDTq.exeC:\Windows\System\fwEdDTq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\StPyELK.exeC:\Windows\System\StPyELK.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OMkjMnJ.exeC:\Windows\System\OMkjMnJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GlyRHAj.exeC:\Windows\System\GlyRHAj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uYxMPNt.exeC:\Windows\System\uYxMPNt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JQJpGTl.exeC:\Windows\System\JQJpGTl.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\iOKifaq.exeC:\Windows\System\iOKifaq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\aWHsMrW.exeC:\Windows\System\aWHsMrW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\guaFEyi.exeC:\Windows\System\guaFEyi.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD581b5bf66927cb2fe7604462acce0499c
SHA130fcf18bd7a2699abd111cda8696a91b693b907b
SHA256692f4044a9a510744857351766f9e4b10b413f49b3b1c1c269f3ae9d1d6f3d18
SHA51247c7e022d9a37beb70113cc3f99d20eee22f563963b1ef553ab55491c62af847eeee1e669389078e72da67f385e928d7beb059f4728a658195f399f30061967a
-
Filesize
5.2MB
MD5987814f3ec88d344d4cf526367e8181f
SHA1ad2d256bde801c70d95639408583332bc465adcb
SHA256e37dd7181fa65f0ef3b16442b8cd78c1e6054c7980c460806c20e69700c0451f
SHA512cf4fb9df1610ab2df5b94035ed892363488fb3720549811aff4f400c646b426eeeebb1df207342b3295be428432cc2bf7b38f77fd5488acf9ab0d2044be9f059
-
Filesize
5.2MB
MD575856cdefadddd18042ad4c9f371d497
SHA1faac0a04a001a9b1aa44a6d889991bea86320db0
SHA256a00c792df622f6bf67aeb80afe3e538d35d3ae86585a74abd00af296fb9445e6
SHA512a075c5818a63050a785406647ef0e45c1efe3bb77261a4dc2b5bb97293b5b2e362b312fa763e0cdf960fd67449089114c0e025f5f5ee3d0902c139326a4d2ec2
-
Filesize
5.2MB
MD5bddddb42d79cb278bd4767fe7b22b5ae
SHA15c08ae6a0907b5d48fed197306ecbb8a0bcce174
SHA2563c629c1c10accc87934e8744644320e873768367b5ae29c30fd21a083c491d1f
SHA5127a08a839a56784778434d28cb16f514990b6d158b23e10f11da745155347c45296f48ebc1d864d7861dce880e0a3ba27db2d9973ea415819e895b07b06a027cf
-
Filesize
5.2MB
MD5144fbd920227191ed9263ba858282567
SHA1b0faa278757d118f1085970de81ce27ad51b6b7a
SHA25692375dc45aab42ce134d5503ffc1952fc3f37fac19ec143580c2fd7e52a349dc
SHA5120847acdcc939083906165528287055e93d53348302e4b1cc9968bb4f8fdddc17e0be39e8b4e118a36340706656628997b8096ea172f5c46971dbdc46ce902a71
-
Filesize
5.2MB
MD50e5a133c4258fd5ff38dfe819b93fadd
SHA143dcb08d9ea964aa5a6b72f0e387e27873b82869
SHA256db20c4de625b163d9a1e5db6694276ae7ab2fe9675c65cc009691a2c773452e8
SHA51202afb95c0da3dad9d04438c6dd03003b595c8f780d778e0eff072d55399b0041b28e6c1e6d67a59cb738ea74345a3ee08731c039e9c15123f0e0782972707471
-
Filesize
5.2MB
MD5e3e3ab2f7918c04aa29f2286cae71501
SHA1f009a63fea4ebca27da4f00c738fcbbcfcd1612d
SHA2564d2e6ca8dc7da4e9b4f76fb5ab96e6aa429f322d4429125d0425620c89797e4f
SHA512246cbf1afc2fec85eb784db1ee39697fa3b3979abd84efd027b85673d9a9b1504465d16bb50b677ee267cb7cfbcfc66b2b9acfe88dbc717e16e69664f449a830
-
Filesize
5.2MB
MD5561141d5174847b65d4d3d42ae6b0405
SHA1b443ffba813df637251f3d2ed7e780a2baa61e3e
SHA256b5060765549455f881f08cf848fe04ab67118a811bdadb14fa64865a4a442bbc
SHA5120cc3879485bec13372ebc768d6b7646b024b9e91c8cf21fc7cebb442062a3a350383cfdc5ceae6d0e22005bf4a08ecb0e74383be47252dcc3fafd326f29479db
-
Filesize
5.2MB
MD5a7fe3af58b0692bba8c4d4095d924e32
SHA1ecddda919e1c86face222f51377f5f0d8f4ec1b1
SHA256a61298d03334f1dd492036e9463bcdc129be237b3b1037c5493d739623d5b8e1
SHA5121d8f2cd1702b206665a1d82e2d2c5b1fab0e4a796cbbcee52ceb9e7aed6794190d249120e22fd24e9267a37674ef19cd2f8b0c8244fc52c64ebca57cd2c68c41
-
Filesize
5.2MB
MD5ec60f5a6f1d1c06656475f213ab69746
SHA193151d53e2aa24e22ebedb7c4bcb01c2c0d725e7
SHA256bc9dc7a076eab8235a4acc99c9283aab4e90207fe1b27efdd2e1c1baad2c102f
SHA51200c99b72e52ed1b003b9f1cbc8ea33a5a0dcb35ee4bb3455797d44a20a2dde250a22243d384961a191809aba67d4e6f254f8eb7c96a5a8280b6e4a95dd6063bd
-
Filesize
5.2MB
MD523c5030caf2f009c849af979f00ea5c7
SHA135f2e25bfe44f9d7e769f2196c35d0d073b0f8a6
SHA25656613e624389f03b60fe5d1edb4e45bf343cbea50c51efe603543f95cef439a2
SHA51234e04dd3a597138ef960d65a1ee39ef4c23c5fcb4e2a0e2ba7c28abb314f7c66f0531da788451371b962b5ca90df504563bdb82ecd1a3b0546aaf6dd1aecf558
-
Filesize
5.2MB
MD5a44bf10c8640b2a6de3c627d65ecb396
SHA1aaac568a8a169010310e5c3e61fdcfe22bd2061d
SHA256623190f5abc9deef5d27fe946c4e07a48c2d58505c7d3352bf2bc1e31d9df693
SHA512aeccb6191013956b7ab363f57396aeffe27c7c1e4a27d940ef39ffd178205ad66eef7fa4a9c4dd21dec11f9b6b92c2e5cb8a84ec1c1c3b4e0eb17afcdfaa7b36
-
Filesize
5.2MB
MD517ddf20a5a7ef98019707302de11d6b8
SHA137a4ff5758a3c930c68413cb8dd038838f5fe040
SHA256c130ed98f90e91a9c0a8bb88436de8909bafe5bcef1686bc32ccf819dbfe10f2
SHA512b5436de9a97d89bc477135cd9cf1736c95bb4dfae02f05e2f59ce90d93034f20fd5dd3eb00a82d9feec66717535060f2a10a27d8d59191f034ea8e0784b83ed6
-
Filesize
5.2MB
MD5e87ad7e8a827e08a8eecad13d33d1e5e
SHA18bf4ae43683d82908b88bf479120b205123edeb1
SHA2560affb2b35cb7728aae5715af3c5ee83dcedf7b43a4f42f42192c98f09803ddd3
SHA5120152c090d5bf154d57e56d332acb5569265b4f172e4665aa3605267e10b55d81afe0d493c2954ac91623414c7e25e344ea5854859f4973e54982d67cb4dff789
-
Filesize
5.2MB
MD58578fe838a15ce8ee3ce211cb0342341
SHA119e6fb9392430d59c11030e4f3f5091946d4784f
SHA256ce8786354c30176570b5770a2c35393af0021d06ab088b4ea2821c4574a9f8ee
SHA51203ec7c246b86d13b001d60c910c5b957447f4abc6d306c05b2a4e517f8dfc4a7467240cfbf3bf8593dab24892a5abb0cbc109eb4ea1b774348f5cee156b25d0b
-
Filesize
5.2MB
MD570286a9b3c866f095804852acffe95a8
SHA1d7eb7905a89abb6b6d90f2c757deb5543206ca02
SHA256c1e0d10785dccd67590e47b97564f354fac0e2bfaf6990b65414969d3a7ab7bb
SHA5126b062ee20f596a1ec59e7ca84113a352ffc6018d472eeedf6de009621f89267abbbbe7a4fe2f0653d2a4c89235999fa73c20d853a939abb449c95a0ec902950a
-
Filesize
5.2MB
MD5a763daa5de1102376434287233e61efd
SHA183ad27e3bc39e853da5217f22e115e380e2174a9
SHA256541697eecccfd1cb8b122d9d590f60d75882fdb9a3489391920369d5b539740d
SHA51298e102e4929431abc63d13d1a50ba9afdf223d3fb7989665a472e69dddfd0957e8cc403e3b1963f795562d5deb14b0bc16fab2aa4ff95071b74ccae834158335
-
Filesize
5.2MB
MD5f4070fbbf1b6db69796650cca18ba8ea
SHA1e9448b60609da1bb8a8d4853ec331c9f7fdf2ab0
SHA25648f639a4d3dce69c057a837ff7075461e4caef50d9957a554bbfd256f567f4df
SHA5125c1738b6f24f12a8a4fa8a8ff893230d8b62bd0f730ba90b39890421fa41f6472182c1556707603d363e51762d47af587bc0d505f999faf15fd258aad2ce96e7
-
Filesize
5.2MB
MD5da50c3ecfcea8741e08b8f6f76994208
SHA1c1acf03c1ee9c724d23e90e649731c2ae95ed3ac
SHA256670d35a057b1c91e43ded83ff51c799812547f372ce688ee4a65d3ddc97e4969
SHA5122e73c144e0d4746cd7f32233f4243bb7f91baa0c72ed4cd7c3f34313b825998d1104715c99997e3f940b8a76f76b1643cb610a1b0aafcc58adce6cdb842b03aa
-
Filesize
5.2MB
MD5219c7c22acc773e9d7d228d52fc149f7
SHA1c68a805da02949676645738e85d8018bccdb3b2a
SHA25673462c9d535c14e8100d5ea5f21e75cd3aabcd5257eeb03918dba5b810ab48b5
SHA51256b0a028b1adb0f8f3ed205c23e32e809176611e45b4459994b168416af576d1b2285c767ec4136107ef7466f34241d54737dd925bcc9d37b03d2c714ebd444e
-
Filesize
5.2MB
MD5fdb9ce2abe0dac1664adc45f535978f8
SHA1ddc05c8c90f9def0ff1d5298334bed8920218fed
SHA2565fbf45a2c38ab3b076212b6ed9995d008c7d40dcbcf6face63cd2a6f5ab98c95
SHA512d1c44f117a105e6f7aeac47f67f93bf9687da714bc5fab0f85100c6325673514d5c5c6eafc6cfc930d1a70a71421fcfd311cfa6e8f54b87ccc9fa1905f77799b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB