Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 17:50
General
-
Target
2024-05-20_2789ebac14a266434c13709f2f8bf0c1_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
2789ebac14a266434c13709f2f8bf0c1
-
SHA1
798d4b52bfa502a9143480fde28d78be09103acd
-
SHA256
b076c05d25501ff0f9f2c9baafe641d8b38df163666a8bad3966f728dd89e0b4
-
SHA512
46ad2e2db675ae963cf2d73580cbe3c5294b5ffda5a4d7766043f8dc5b6dcaba11c9856442f2f60653a7f53ed805fe49cca634d23f68b4e0f4a9239c8e832a54
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_2789ebac14a266434c13709f2f8bf0c1_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_2789ebac14a266434c13709f2f8bf0c1_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PaTcuxu.exeC:\Windows\System\PaTcuxu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\tAXBEoo.exeC:\Windows\System\tAXBEoo.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uQaXeHR.exeC:\Windows\System\uQaXeHR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\UlOgGLg.exeC:\Windows\System\UlOgGLg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HUXRCKQ.exeC:\Windows\System\HUXRCKQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ehXpbVj.exeC:\Windows\System\ehXpbVj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cqzSEEG.exeC:\Windows\System\cqzSEEG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hubwVDO.exeC:\Windows\System\hubwVDO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\YyETxZV.exeC:\Windows\System\YyETxZV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TtwaSnW.exeC:\Windows\System\TtwaSnW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uGiGiSg.exeC:\Windows\System\uGiGiSg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jBAKPAi.exeC:\Windows\System\jBAKPAi.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\XthFEIG.exeC:\Windows\System\XthFEIG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RjVrfvT.exeC:\Windows\System\RjVrfvT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hUPhQTI.exeC:\Windows\System\hUPhQTI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\aHjyxvJ.exeC:\Windows\System\aHjyxvJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\NyrqLeS.exeC:\Windows\System\NyrqLeS.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uXXSFhx.exeC:\Windows\System\uXXSFhx.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nPLvxQC.exeC:\Windows\System\nPLvxQC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kkiImsV.exeC:\Windows\System\kkiImsV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KjViGpm.exeC:\Windows\System\KjViGpm.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53ee763766378a763dd3f1559c5708b17
SHA10d8a411cc4f8750ad21f381f9a479b1b3eb76c7e
SHA2563c6062232c442cae495fdb3c39f661ccde6ba2243c5d2a854457f2f4a6bf7c04
SHA512cfa203374b9c163d819259ad2490869be66887fcecdc1b8e4e43855b5669d385645ef334c07d6cf0a82160232a445f896821c1ad375ce7a805b50bc49d3308c2
-
Filesize
5.2MB
MD5db8dc5004d6606e2909e13469f110151
SHA18e5bcf7914fedb19e4044b4037e4d7e831da6ec5
SHA2562d6c437eca5651978a579a2621bdf5b548173cc79546f1bb8f8c9bbaa744c559
SHA512cd75487437a8e855514dbd7cd11031a9cf9527009727b1efb899e22f5b5fc9d146ba2fbe508024c43bb4385dee9670b2bedcf3960d4294181202f109b4031962
-
Filesize
5.2MB
MD5c7a38762711e8ddfe006c98891d93882
SHA12bf11eea104f7ce73d52793e33714af21be1a28a
SHA256bffceb97dd932584954c15039aaf1e87ee8fa45d3a85982554e9345cc34b8c5a
SHA512019917d5f20fde067cee2278222b8a7d5a897e6112622f5dd02c91bd2a5f50964f592952265a740094ba759626d91d5f4276592ed323397625b9e9a1429903ea
-
Filesize
5.2MB
MD56a6efd5975fee62c6a4a004f59c55755
SHA1c8b121a0b8cb4488c45ccb8b2422151a9c090b8f
SHA2568f0f862abe02e6249a558fbd8950bdfa7636c8cd9192ba906459444af3548474
SHA512441ee5107941a8582aee1a7c40f34ea609119fb0199200f13125aa0d1265b06545c1dfdc0e97cff6ef34082642d3827d56fcd69fd2dd2cba106199fb2897dc08
-
Filesize
5.2MB
MD53a8b9b3ebee3df6869bf59bfefb31d98
SHA1fc7ed713633182b9ad2b17755732442d46ca5bba
SHA256b4c9082e3b01177e28643efa1115629dfb7d9358fb70f2226a4d78c95c14cb62
SHA512e86a34407fa0553c87a998987a2941701f448f90484e66d03bed8e0c0034bb2a5e87e0092232f1e83bbe7e7686b84106cf71702f7c150c7861b3875f86c0e1d9
-
Filesize
5.2MB
MD5c396f7552610174f2ccd10297731702d
SHA16a1bad0f5d641f909bd84659381dd30cce270efd
SHA256ea6ab54dfc35df9b9b5265d8137c2594891b47902474e037733496bd3c78a1b0
SHA512462a8831de963616fad09da9b710817d6ee2f92ab5f07ff73548c5c983f128a8d40ea59e60b255e0459dd514594cedf2e4d067f1d62559a0eabd5caabc0b2b9a
-
Filesize
5.2MB
MD5e52903e67d27670a954e4d3032e175dd
SHA139c6b53c331de5d66b55365621aacbc8dbe00bb5
SHA256faa92d2a552cae9e49e037736891ebc7f8eb0c3538c1f91de1217096dcef6371
SHA5120b549ac12e4d55209ec06837a22229d8c5e06261aca5f9b9cff5b2d2961e35615bc5856030b38d62e352ab718295c28bcca05e46b0d6ae0de423e4f6e4d6975e
-
Filesize
5.2MB
MD5148c2acd7f59458b0c003e83dd9106e2
SHA145af587001ca3f3d956f95a117b82c1cedaa2c3d
SHA2563ef0833c3377af0101dd69c557be059c0c54ea5e2dc722813d59b498153d944a
SHA5122b64ce090d4fc12463e896d195cdc53ee9929e99132f4d6c1b3cc3173ea66f59e4f1c59eeb7506cbd45e83c9296302a77e58da345a5dcd278cc7d560df5742b8
-
Filesize
5.2MB
MD549c03b97a4f71ac026e19cb5a7cfe82e
SHA15308eca3559826dade2672d8f01561c8d910d685
SHA2560a9bb2cf43cb954f52082218a6b2de13132e8c8d6bb84056a7f6b41107e901a3
SHA512cfc4cb0bf5fe2806a17a58d18d4229a69ef96967849b78a5672bdd89b82bd8feb1fd3469c8a3d049f87cda946af7855e19407f42707fae501719db562ca65e43
-
Filesize
5.2MB
MD5aca20077f7adfb79639d3485d892a589
SHA1c957f0611a7b3a10ad2f2e5e1413dc5e304b79c3
SHA256998b3c5e65e3319c4500744cf761900b15c9b1f42f56589caf54ad93eed7229a
SHA5121513dfefea61a55aa2e1b3a9d31772321cff908c84bd9a62baac1d261958bc83c2445722036e7f0398887e8f3c6963596797be4f6936e17405c9c327362ebf11
-
Filesize
5.2MB
MD5bd33b178dd71b52b7c89c89e1c81d524
SHA1d7f6b56774ca5a5b27b4674efbd371a3c3078402
SHA2567f9819dd7527d42e9ef498aca527a0a0436121b6b439016de46b4785c7f98343
SHA512055d902c09377f2883f619418d8dc80fefb131e1a3622bf92da606802f1a031e9208c812710c16e8fb96d92b6f203d776385a8f5f0b8962d7734368815589985
-
Filesize
5.2MB
MD58e9cc4f71364f18055e3142f1f8ef934
SHA130852d0cc92810c90187b309b250f50b3fd72511
SHA256d0872dd08389f8d9ed6c7a9660ac2cdb05a6c982a5a50dc25e83bcbcf94181d2
SHA5121b6006430195b0937fa4390ccfc5f8163935ba3976d9a64859181728dfa63312a29f0a4939ab53ec2c060d7b9b14abd7aea369a01edb647babba685bc1adfcff
-
Filesize
5.2MB
MD55076939079828584cbabfb81b9d31e1c
SHA1623dfae24162888ad0ed50bd1f3e6efe36fba40e
SHA256fb8b04115f9dbf403f3a3197a4718147a6601a16981e95d83874cdd3fd57f9d3
SHA5127b00bcc8de6fd40f2c0c2d72e55f1287bafca5300e42cfb92b8a56ad16b2fdc3dafea335711878c7b5060d39e3f9f764c3b1c9e62d35de3e3e20200580c188b2
-
Filesize
5.2MB
MD5029bc51cdc1dd191d3be495b868e41bf
SHA155145214c6141dae0a3d02ca9255a30acda99176
SHA256076ca7edb58e6e7f0a2356eb72e661cfe731be2da8d853bd03996d4b359357db
SHA512f2ec48c0d87f2f813092f97488b41b1184a3cf340a1760ad751483952370f2b623d2a5decebd5e2d0acdad3127e296af1a712fec7fc6490bee00213181824ac8
-
Filesize
5.2MB
MD5c52d0226833530adb51e0204116535d6
SHA1c21b49b676ede4d95ba3c2e8237a28a08967374c
SHA25649f14fffa3e4ceb0ac8b928096dee6e7a0aca6c8ecc60f3fab570aca10bb4b9b
SHA51255abbe091773ffa3bd1b429d26d46b5871fa55221ecc86cbed30612820545e8e60e8081c85b0fe101a4e4acfa0587aab81ff9841fae475e1785852054e1b26ae
-
Filesize
5.2MB
MD574c086487df396c7aa8756131ab3bc73
SHA18675dec1cd6b41df1ded7d93dd4b05ce43be9978
SHA256fce489489f7379f7b355031da6f4347a0b3703fb8e947c6dc77eb26f063abf42
SHA5122911be2e3d43d9b7f300d0ca7cbd3d13a7195754285e25584e27810a909e909b431fa6b1bdd9f22c1cfc03a68730998ce559421bced44c6632fe7fed373ae9ba
-
Filesize
5.2MB
MD585e3e6945c702a52003af151d0522586
SHA1a1899ba7540186a4deba9842a5d02316c62ad7e8
SHA256bd5a5cac1d85fede2029e3da20983beee59ca5e6c969e61caa3891586fa59d3d
SHA5124196bd53a55afa2bb781e74878269505c9d1f5e3916e945004b7c0b51515924796d19d36df6af3801838801708d95f2c51f7cd0e44068975129e3ecbf5ba5e10
-
Filesize
5.2MB
MD5c18b057f962d6eedd3698d6056303824
SHA14892c2724cf341b0d049bb242e149636a0fd148c
SHA2560ec39ab8283cd535c517cfc6cd98c7992d31b3fea3e61f599f1ef4853fc5714e
SHA5123f42b838acd23b958906f1a1603e576975432e3655694ff51229e912cbe67012b408b6f9d030e787f8284a61332a4618c7a346865e2cc379a5cc085a15084079
-
Filesize
5.2MB
MD57311e758dc802792c34f9480f01a658a
SHA14c1cfc4554902725526132266b69eb6a4e542d65
SHA2566e57a63bdf73b062f2fb2f85323a2fa0f4cc0ba93c4ec76c7bd8e1e97e87ab45
SHA51227c0ffdc300e652a13302b63ade5e49c43c6f6a47b9368df13545477681fab6e4fab277464889b6e726e1e9fd264d925b7a3bc98485f27f47a69818322dedbdd
-
Filesize
5.2MB
MD5e89f5159c71d31c06249ea08ec1d7df6
SHA18bc9ea18d80b132d753f6cc57a9647bdf7446bec
SHA2560e4805d2ae129c526b3d879abb6e2c15499871e0648dba3a530447854a9831bc
SHA512d2a8ae20f4ba83ca0e5eecc7e708f5894e6d314fcbd35abed61f23208ffd30698d5002d0a9a8c06a6902db72e4108a02c3f2131168d3201228c7a1e111e67d4f
-
Filesize
5.2MB
MD5a667800a73789dc03167b16a160e54d6
SHA19d6bff3f550c9f1714b6631c75fba00dbc104cee
SHA256b06b53834780d995a216293322b7963bdc8d003d9bda7678fc28151fbc6cfaad
SHA512060c938ab457486d9923f4d746032fd15078f4eab8d36ad3cc50e9d95927e56ac1a3007acdf3c97971740d41263e27363894788b2347fb85d53294ff5b4bfd6e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB