Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 17:41
General
-
Target
2024-05-20_f841b0ad9eb5462e9ca1eb0a3149cbc7_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
f841b0ad9eb5462e9ca1eb0a3149cbc7
-
SHA1
514d0e8f419fe084180c49fcbd4239ce338a3844
-
SHA256
a9b48d62702ce0649694d108b0e09bec566805d928d73030acb6e64fc5a73032
-
SHA512
6556e95ff456a434bb804b041ae8dac50a34ef6c01660417bdb26a9666ee8e3b39185d4f1b37a67e53a5a8200cfbe38308b866cf2975e7b366e9800511572f0a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_f841b0ad9eb5462e9ca1eb0a3149cbc7_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_f841b0ad9eb5462e9ca1eb0a3149cbc7_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KzBiJuE.exeC:\Windows\System\KzBiJuE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\NxWzsKk.exeC:\Windows\System\NxWzsKk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uqEzizx.exeC:\Windows\System\uqEzizx.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wGAGmKu.exeC:\Windows\System\wGAGmKu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yKwoHbE.exeC:\Windows\System\yKwoHbE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RAfWSmT.exeC:\Windows\System\RAfWSmT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LynuKwV.exeC:\Windows\System\LynuKwV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\oqzvvpi.exeC:\Windows\System\oqzvvpi.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VZcDRct.exeC:\Windows\System\VZcDRct.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lEZAiYr.exeC:\Windows\System\lEZAiYr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KJpiLAi.exeC:\Windows\System\KJpiLAi.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QwVZQCY.exeC:\Windows\System\QwVZQCY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lEUpfZk.exeC:\Windows\System\lEUpfZk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\mHVcSqh.exeC:\Windows\System\mHVcSqh.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FlVhHtk.exeC:\Windows\System\FlVhHtk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PRnVOke.exeC:\Windows\System\PRnVOke.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CYDvliY.exeC:\Windows\System\CYDvliY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GMoxWkq.exeC:\Windows\System\GMoxWkq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\boLvWtH.exeC:\Windows\System\boLvWtH.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\pGpWJvb.exeC:\Windows\System\pGpWJvb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rnicMJz.exeC:\Windows\System\rnicMJz.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD581c6e291336494e674ae70f02b7aa95a
SHA16957de9685ec345c1eb0b711da4851784073fa66
SHA25674d1b5d8a1aac4291a0d0ebf0f64c8d252f9625de3387d9099ee050ed343c683
SHA51269f7ebeb80efbad44ef9c42920f468545a6ee5be1ef785859f607c179fb24b4ab9aa27f9c168c8ee1f2bd2922932d619a3b4bfd52047db1c10e158b84a12297b
-
Filesize
5.2MB
MD5afeb3d1c53e63252c0b7f6f402ee748a
SHA1f3660aff36521f9e1bb344951dbd8aa4540cd869
SHA2562d4e1c69a1e658a6539a5b3ff1cf4707af87e47c666296429fdcb9916297bb76
SHA5124c586c102d2ce8d9be2e9f2f5230fb47cf637c61adb4c9973e16508dbae75c247b7c401c1f0e8d34b6c4a053b12acddd43f5de71f26e3024b4757378602f3905
-
Filesize
5.2MB
MD52f74f0e83f41e50bae236a0bf4c88d7c
SHA18f77666ed1f004a300c51c5bad27745b07fbfcdb
SHA256359a5d1c61b397aebeae0a4e9e773ffb0f952583d0de19bfee9aec6999a50bd6
SHA5129b105d510dfdbe69ae56f8b021ca7836180bb9344b51a89de436091ca4f67e0111f7544a6bd1c39d39e7cc9ba2f9f34b494263c945404dbac33c226713271d75
-
Filesize
5.2MB
MD530058c627623e0589a18632584d89cf7
SHA1d9298df5aac0b4913ecfd7be85dc5a161009d642
SHA2568930ddedbbeae4dea23e3b417556241f0e31f2678dc194f394d1d133b78e8d76
SHA512999326208e8407e630467121a454ffe285fc7e5fd5fe8fa24d4481b01bc46d3adef8e03f169bf4b2043899ee11582fbde5a62501dfbbd364f8bc150444d47c3e
-
Filesize
5.2MB
MD5c2ef583d85d6638f98eff950462760aa
SHA158febbe4e8958cdae2c5e1b43d052060191e0e73
SHA25698e7fa49518283d4be750dac4a454821e35700647735d6c4009fe75d2aec241e
SHA51298d38f5eaca0fcdefbb52990c2bac96100e9b06df90d107c86a3501acc9b89501944004858a9b909d1e559bd7c004082fab9fd1a61f482e53f7228a0e5a5b48a
-
Filesize
5.2MB
MD54eb7a0af5756b11df848516a0242f9bf
SHA111d4bc422d624823b1a269fd6ab2918d0c32c7c7
SHA256e6ebb297ef1ddfe600149b0dd6cb4faf8b8aba476ae47273a0c926ec70542617
SHA5125ac8c5f4b68021f7845e2a65b4c854a9491a774aa1f19a9109b3f9264aa260ed5643cfeb25a2543706e640cb2c3cd5e0c40f21808947377e5e5a4a506b80d1d5
-
Filesize
5.2MB
MD59aab25a23ba451d184f037416d981cc0
SHA16447ebfd51cc954b59a9b156c596997f84bd18d4
SHA2563d02a312084c152557d1a71fca4e1b576840a39a3464ced242dc4ea630a859d3
SHA512519d0a54e8490e827d05a1076ef5326eecbddcf76ae02f24c7f8ae293f06854f03df111b32e386cb359b6fcd9ccfb2ae6e12d671bd2cfee3586e004fee383a20
-
Filesize
5.2MB
MD52494146d8382c04d8d2302cfb4959159
SHA14f8da4de871a3ea5223bb1e715fc609619b3dc56
SHA2562b2522e0c0c5f58ce736d521634a21f2ab31fcbceea8b31a7acc62a2f4682d18
SHA5128f87dbe1b107a2071e38b3c36a7824ec5fa40312d7fbf050c67b38dcb12d05daf0116a0f1cdb88850e8001d553b251dc1568ca3dc1e5ad5cd4383247f0811487
-
Filesize
5.2MB
MD5ff809149f08efa67b0c072214f92d34c
SHA1e46140f2f0ee464c2e0daede1fce917cb3adfd7f
SHA2563db2a235d380fac585184c9f236cdae2dbdb15de18f68cecfe07fa1282c627b3
SHA5122f297ffe414a91df66e4719ac06b952561670cbb7460b6eba7422ce4cf09fdac7b7f491073ea25cecbbf9966833bda1dc9c9b9c2e70fb0ae1134f6c1f84a588a
-
Filesize
5.2MB
MD5e555ac2b57b063fa170ee5954d7c6a57
SHA13fafa2c8ef6098295adf5e01894444b19912ab97
SHA2565a713692c9c954b87cb67b5095fe6ce664219ebfe0d2cbd77a5ea61643240800
SHA512601bdcc3f2c80752cb7bcc2aeb8e6a7f8bf89b652b9fce724e8f2b38a3928b4725372a2168c8067a4f33dce0aa026281eefa7417aa859e8aa68c591839f899a8
-
Filesize
5.2MB
MD53f877e3deb9a9fa491b73aff52baf8a9
SHA12bb9e9115cf2162cd69d1125e7e2e799d7904711
SHA25675aa319644dbdda1aaa6039e8236336118982ab0661c1026a98f6120547f9c9c
SHA512206d8ac4eca3c328468f05387f08a9f7e3de712254f766426c5e00410fa30e6d20a324417f64fa78772f52e8e4f95408aa88e2184761ed2e59473cdfadd5bf6a
-
Filesize
5.2MB
MD5488bcf3e69427b44f2ec66b5d73473dc
SHA1e9d8d19bd93b828a8fa2072feb992c1f0f810f5c
SHA2562ced2f7b3a0ae7b9357a5da1aef8e37ee7381de70cda7f0eeb00641a9565b66a
SHA51246e748979116580104f14c618c972031c6c741d25ac08fc3987f42ee2cee746c285a2d05db65e8f2a19342af27d0d1e7d76a228f0464925255647d3a1fd3b353
-
Filesize
5.2MB
MD58da30e7a70b68aeb57480d3487ae736f
SHA189b329c88ea383c523f7f414cbdc3cdf63bcbc59
SHA256cdebf756300d8e8995bbb5a845a9f867de7bfce38d250292c5025f6780a889b1
SHA5127550a3b046cc3248a1cd517e5f62e8431ecc3ff4ba60803d824d4c84e95647e09d09adf6e616b6ea7f296f0670ef7558368e418b4030290abb3c56d987760641
-
Filesize
5.2MB
MD551944ce299edfd93e6ce19e1dc1535ea
SHA1ea11cfa6fef0282fc79cc753136aaae49be14d9f
SHA256670a8d8af63ac77530ec0ba803b4b80e36d988b819da78e545bda3d9c27f24e9
SHA512f29764e627ea16d8ae1d495b6387560255ccea13c1fd8e84be3f28f1450483f160d03964a15f46f660fe447770dec4823fb651fdfc02a7c581faf9a07050e8ff
-
Filesize
5.2MB
MD565b8f05cae2240c7772a0a34fcfde232
SHA16ef2d8114c02d1b49b8cb5df46ecad64bba80937
SHA256d034d929da55e24129434d34b9265d86096ad1a058b884a71129afb26347bf76
SHA512bf09072caf074c2f70a08443b7c1127f4eea866cb1558ea448aad67b017a3c4adef0f619ada755b5e15c7b6f21ee4ccb093806901f1a6c5829f8fe2ab46fe2ae
-
Filesize
5.2MB
MD5357c0bfd706458e8f9d837525c50d46b
SHA178a41058fe66d23897d5e456ec4e309748a60586
SHA25667fc2596b68e17a3b1a73fc3eaf6c493f20a6e34a22bea2aa3b913d00aa37910
SHA512d3b1107a9de1e534e4c6a8fbebc7fb0d5749c794d10a933157bef627cf20aa854d893284aee05f39fc47535a7e8886b61848ee8733ffd56afd04e0ef4420304d
-
Filesize
5.2MB
MD58d69d2684fe6526f42fdd188dab3ce0d
SHA1a73fe9a0aeda0e683e2863d856a7890a4ff84217
SHA256ed7552b36e9e5ca1351342ad2f328a821a9ffa8d33e27d0ee66dc828f87b41bb
SHA5127dce6339b4f6721341df62163b78d0e84615a02f2638082afc5bb0d776a88a02f819e07e357c469eaf0fa919a4435f0a9d4f878b74a775dd5cda3103c12e377d
-
Filesize
5.2MB
MD53ee923aafa0b0df259bf32162a2eb94f
SHA150da366a900d13c7d3a7f28165db55942c79e680
SHA256a388df6044254a8995e0c0bf2fd0357ae69d065b44f7887f5d360c725a446c3c
SHA512c3e1a775591c687243b06d4792be61edf42f328eba65c1283c77410edadf7b011e24494a088d9d605cb6d0cccf054ffb9f7b1eb73adb10a9158f4c68c32be8b9
-
Filesize
5.2MB
MD54eafcc545a6e5043baf00a0f32bef147
SHA112fce7cc1c4c0e7059f0f2089c8cf92eb4255176
SHA25676cd5f3b664d54169eaf93dd48f4a9a0ddda941f991fa440a148ff2a9cde02a4
SHA512d12335feb3774443e527f1d2302b78825f6f8c65e7a9faefe8d0bdefbe194f66ce1d1cefe3d650142e92c4caa0742296f5a933398044d7ccba4063cad3ab4d3e
-
Filesize
5.2MB
MD5934686342789eea72f3f542e88626780
SHA19534823437fae679194129de0d5cc45639cf0f5d
SHA256d88560d85f2b620a4433e1d218cc65c31c033b5690434f198894178826bc077d
SHA512f45de88efb916f9899069d5a78e51629d80c9d1529b94b84f436cfcf0efa2d090f5ceaa3428ec4b3c09e279288b6a35128f17a64c7c772acae5b1c4028554fdc
-
Filesize
5.2MB
MD5d8d9b2e947c02a2633d2101f719d6324
SHA1b40017ec7658eaa7d9735152722c445e70cba669
SHA256060768e298c6a515c50bd1cbc9a170ec64accac80707c1df82ae634cf1ab67a3
SHA512753f9b8e3117e9f2792f0c8955e104ed4fea9570edb30d18deccc4084343b02d2a9402f202b86bc0bd62581b77497edc55ecdf09d5c25ebe357d4671670609f6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB