Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
20-05-2024 17:49
General
-
Target
2024-05-20_26c7c01d881e5043932b5f8eda89971b_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
26c7c01d881e5043932b5f8eda89971b
-
SHA1
0ef328fbb328730c56b31f39f5bfd2272029aeb9
-
SHA256
bcd5d71d1793a073dfe7d870bf5cba657ea82d5076346f5e1afa64f54512b5af
-
SHA512
60852d342f1acf9ccd53af1574376ffd3330e56051b16924cf5fa225264454a47abfeb728036d22e11540e666fcd4194b7a5e100522bfd316d69fd4549ca3856
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_26c7c01d881e5043932b5f8eda89971b_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_26c7c01d881e5043932b5f8eda89971b_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YHsnymK.exeC:\Windows\System\YHsnymK.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\eaBvCXz.exeC:\Windows\System\eaBvCXz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zDlYhyj.exeC:\Windows\System\zDlYhyj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BqPSZZj.exeC:\Windows\System\BqPSZZj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GxOJBNY.exeC:\Windows\System\GxOJBNY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RFIJdMh.exeC:\Windows\System\RFIJdMh.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\eDKtdgf.exeC:\Windows\System\eDKtdgf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uLumOYy.exeC:\Windows\System\uLumOYy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\EqIdqIU.exeC:\Windows\System\EqIdqIU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kqaUUyd.exeC:\Windows\System\kqaUUyd.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TbYXDnH.exeC:\Windows\System\TbYXDnH.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xosoISu.exeC:\Windows\System\xosoISu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zUiPrXr.exeC:\Windows\System\zUiPrXr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xntVeBk.exeC:\Windows\System\xntVeBk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OEzWFgR.exeC:\Windows\System\OEzWFgR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\vdrQvsN.exeC:\Windows\System\vdrQvsN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PiUlOwD.exeC:\Windows\System\PiUlOwD.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\opijzrt.exeC:\Windows\System\opijzrt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wHQNMLC.exeC:\Windows\System\wHQNMLC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jwLaXZV.exeC:\Windows\System\jwLaXZV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xpdUgjA.exeC:\Windows\System\xpdUgjA.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d8d8b706065cd16c589adce0076246fa
SHA1ee9a6b940ef52d885f66167d296abad9db78a8ec
SHA2569413312738782a8a14f00d8292855ec0b834dd9ef0c7f133c85acb6c5f626a78
SHA512c66876a44540310d7479946b415953b30dd9859328b9476ebc0e75ecc44b46c8c4010ab78bda7895b42576455048e19cd326359958ce531bbb80de2962e8ea5d
-
Filesize
5.2MB
MD5e22bc7bc167eb9b700b76b5ae06f3010
SHA14201bc1b46ff296cf849c6102f8c9748a6637d6d
SHA256be709705c87f306aa7eb936f580d5659bb2d90f6f956a4d9c71b36e7f00a3cb1
SHA512e29a207b3d60a2c12a50aeffba7449e96944185a57b761b6849ef097d8979e184092e91b09d4005da958c4188c0cc85b0636bf4e1ebd8c07092daffb39dc4439
-
Filesize
5.2MB
MD516b56d5c410d900d164b40bcbe519d24
SHA1d98ccde0b68d7cf1203cc4f6fc967233cb7fd398
SHA2563169c3f5fcadb7e36cdd96290ebc188e3f8b158bd5f9ee93e1e8e2287f08d135
SHA51207855ec9d7bcdcdcd176db25ed8d66adbba77f2ad63396c71efb0a26fb9ccf2fad06d58f5d72cef88d80e4af8a439fbb0422721ad14bed70e43b7bedeadac116
-
Filesize
5.2MB
MD526d133006c2a6d0af6b25085a7200591
SHA13d7d0b3af439d3547a7fafd1310ea973c583710c
SHA256ad007174c5345dc7b818b2ef8bbcdc105146409b6764332365e960dacd2372c6
SHA512b68160b73c74f4e83d14c6c9158c3e9256f91e4dac3ac1b3fff9cda4f94d214951c1a16af2c77b55b9539dfdec80a77b52ec8fa2f9ade0de239740e1b4455b29
-
Filesize
5.2MB
MD51b15c97e32831c8017a604f6a9ab001f
SHA1ab134176f0bd4af76f6ea27b03e3cbe4d3345636
SHA2562c9473b7e6647230cf9f9dd7c6a3abb0db91441a7a4efa81a928f95628ee3a92
SHA512f265736417fa8b7a085d7974d7276c75a3a944713f7bf448e7f7be89708b02b73cd84ec214c3827f98894ae80ec8dcc7cf54022b3dfa4b20edfbdef0d63afbb4
-
Filesize
5.2MB
MD53448eecb64d33685006bb9b1f4bf7503
SHA18298b984ffedd9f2d657ee033307497d2b8464ad
SHA2561e13c63cdf48d904afcbb2cda659002e647364505ec53b1048b6b706086ae75b
SHA5121574c2dc4bf3eeb31064c3d1949f4a7539038ac59278436aad8f9d6c0293f476666a441ab4472f108d0231d24f57bf9794b7830a3eed381bb32871c6c73ea315
-
Filesize
5.2MB
MD51f61746a81c8c7d78558d3a93d81ef35
SHA10b2279878ab9c8eb4a94ca066104bc27b4cb148b
SHA256e104819e946cd411446ecb0cd011f659b293b4fa64060651303b5cdee73757e7
SHA51289490e25c000e3ed23f773838a71113ab74a77705ad258b8cff2d587dfa14c7bf244116719df91500984cf0c619913fcbc910b36849e1dcd3b0f416daad30a49
-
Filesize
5.2MB
MD5d36f862ca555737050dd9b4f93e97458
SHA14fe024b04dfa589383e1eb483500eda239559921
SHA256242f8975af9e9cc772ee812ed9cec2832d9a683166be17b2782f5ec26dfa4eaf
SHA512fe0320777602c9ad4a27ea4156ad8b42c1820ceb8c335d1f061b0089d047ba1da6f1f0900b8e2c4a13643b4e2ffcff8b6d2d8b5f980407084a1815c8a68841b7
-
Filesize
5.2MB
MD525512d2b661eedf2f3a2691f6d7eeed8
SHA1804787a78d0bef244b5d2fcd6557935e33c232cd
SHA25641dd3d5526472e7938c9923cb09b5daff45d5c48bb6ff5f03916ad0cb6ab5a24
SHA51220c36a754f4fb48d3566730d7f7021589b168639d67d8595c8161bee061cb1a274ea01f05bb06a321a230d88207f286448a3b74e922a0ee1e5f4885c53a29fd8
-
Filesize
5.2MB
MD519f22c4b0d8765123e34f5b743cdf6f1
SHA1e4114d5a4583e3dd69b372e82aedfe9c3527ee76
SHA256a5c93c3d62ba74968e6c7e472b2ba020eb85b30af9aeee5340ef332a2e38394a
SHA512dea1153b60c51a585a730641e47946286ae7d0daa3c402a2fb56e249932b13fad8968f0c2315bbfc992bdec3b0949a67ca3c5b15a2fbcb6c13808723a2b09d00
-
Filesize
5.2MB
MD57d6c7757d13a54e8150da775fbd9f189
SHA152ff2722bdb8ac2d1b6167ff3d1b79d8e28afd5f
SHA2560ca42b27738d94d7421cb17494816a802c9254b4df4f5e8ae539cc4480d73221
SHA5126937b4824380c0a385ccc6b9223aae828dbd453caf118abc74a45c716508292455551bf26a825af8a826708fc39103350f59649deaa99a5a95249f011fdbe502
-
Filesize
5.2MB
MD5ebf03068de9aa0a9c93f342a57a5e00d
SHA1db7b3c7c6b25a50a7c02b625c9b56de661c32f72
SHA25612d517447146c50a9dab21acf3458bd376c667a4834b9677c23d24f8eba2e848
SHA512c856eb8d2776629921828941bdce8cd0d352253424180c1e3882fe60b127047d32243db559d0d9dee37cec1945195798e87697f50da3c833a23774e3feb3ca00
-
Filesize
5.2MB
MD5bd7b77772af82791efb6ec809b2f8175
SHA1937e06f4bb89a45dcf4889d59486015bf369b6fd
SHA256c63c78083d5c0b217105dabd95c516607f0cff5c8f4addaa5d65cf637ad69e5f
SHA512a38c52ebcba209e64627190300311e9f7b305a427574ac376b63289bede5fd5065636fd463ff0520ef398963f49c648610f9647705e88cb11b29dd2e93cc18ad
-
Filesize
5.2MB
MD537b2ccd395d942d3d72e0fab749a1f33
SHA1e64b77cda38d6583443233d0483a2e1a4207c305
SHA256e4a0d5c2fceb22679e5d76943fad0a8b043eeadd9130f86277a044bb86ce3ffb
SHA5129c467cd8ef695a5faf6477e01717b428480ef2206a44ca3cf9e029dafeb906fbf2ce0aee9c2cda690aba3a1574e801d1a4b173ab881b8832b1b6eb3ec63b1748
-
Filesize
5.2MB
MD571df652231a83aa462baef10514a2e48
SHA12913d68de5ef8bcd1d98ce95000f95aab1ae991c
SHA25654d4ff79132dcecf74652065da8c9cd843e526e0998effd5e428589581db0673
SHA5123345660b3bd62d5265704bd4152a78bf8c88a866d44bd2d9a66677b6af8c6dedda3786b553a448a04e585f744998fc31e6d124d3c0e9f46b2cb3201b468dc57d
-
Filesize
5.2MB
MD5dd7f62168b1940e02bd75ddaba3d7c5f
SHA10dc7a5feb8dbf2b9da26ba574a45ff9d94e5f151
SHA256e43ae9552f3ab2b302c3be605428080beddb6d95e70edfaefb21cce8226c8618
SHA5124c822b3dfe988b641d39831b9881a87c445c37ff0c97981cec326d9bb59878d1e57798362f4d5da8f30fd2c4f2fc59ee33bce6cf579ec9c935c7b8a40c37fb8b
-
Filesize
5.2MB
MD589b998288e29c603c1cb9f8fa377fe84
SHA17655f96968408fa9792acf5ef680342c699f2654
SHA2566c17338ffa3f1916f96601eb8f212902eb51718dea13f0db3be06f4e555926b8
SHA51208970bdfcfd893a9ef973863f106236c11eb5b4bc94fd69a1d4c79cc44beaab1875fbfb94a125983b449a39cdf841c475290fc383eccd15b86d8f171e32a8c75
-
Filesize
5.2MB
MD56a5f958d2536a869114c2380821fe6b0
SHA18b6ce36c3a02ccd8364d38866707b333293ba933
SHA2562af8a2d5ad59b76bf2652b252c3f10386348a6746005e0af134103fae3ef1ea5
SHA512e63c1960fa51fbe1456f8a61a69b857aee37b3f087d860df3b3bd20c9c512c042eeddb8cb56ce6150ea6598841a16c2c15be63976b1c287939ea01697cedee22
-
Filesize
5.2MB
MD57b9d0ec56b01f904b5b84db583efbf1b
SHA1920cc3e76354eed85c0c04e9c50080021d01f37c
SHA2568c0aa7cb4fbd0732cf3267d05674284a08df3fbd3d526c95aec1b4b46e387a1d
SHA5129f7c4f17fbfc0aefbb77c5e0f694f776770a6bfd10bb62cf7b1af97805f4bba619d587663e6ca326d9f7bc9ef1210b085eb91d89797a204c835d1f26ab6540af
-
Filesize
5.2MB
MD53c8e1cb898efda9979d650b998c7a164
SHA142b4396531149a1eeb618f2c0068c896ebc94837
SHA2563d22986320e92844507de9bca5467dae932263fd2ff49cb229942224268e7332
SHA512d3efabb994447abcbe9551976f374510d3fe84138d7a6f839d87a0c73c7554b227b9973a9d39b2f5def37b315f4d146faefdaf119f795575cbda16cc6d8cc1a5
-
Filesize
5.2MB
MD570a31e53f0074eaef631e5d34dc3fc81
SHA15fdf316dc0e0a5a0d3f7a9a59c1ff56993b4ef0d
SHA2560966aaf080554da387034f90e72a014d410bb9c70860aa9f691b9a508a126eca
SHA512c2711e1295652da21862867d1028f1fac796ff3ce8450051d7616b50e23888dc5e3dfad9a872da380c1242f6178f8a3df75149c205a5757dec4e4f416b383a10
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB