Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
20-05-2024 17:52
General
-
Target
2024-05-20_2ded641c530bed74b9a94c14e707963e_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
2ded641c530bed74b9a94c14e707963e
-
SHA1
fef48e255960b4d6632a89a50e6ac9036908ab73
-
SHA256
e676a099c9b89390acbf118ef728ffde42fdc98bbd08c13a3b0b3d0d163986eb
-
SHA512
041570d04cf0a3385fd602560f6ce01d804b2a74987ddb1b2144f975c5bf181629ef708dc8c7196fff37fce78b991b227acc9ee44385f07f57668933d13e53d4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_2ded641c530bed74b9a94c14e707963e_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_2ded641c530bed74b9a94c14e707963e_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ynQFgaZ.exeC:\Windows\System\ynQFgaZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cOZximE.exeC:\Windows\System\cOZximE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jFqhGlM.exeC:\Windows\System\jFqhGlM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BxaJait.exeC:\Windows\System\BxaJait.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\suKSedy.exeC:\Windows\System\suKSedy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lGAbIjl.exeC:\Windows\System\lGAbIjl.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KYMUnkI.exeC:\Windows\System\KYMUnkI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\SZfmMbE.exeC:\Windows\System\SZfmMbE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VCzXrKc.exeC:\Windows\System\VCzXrKc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zgzcGCX.exeC:\Windows\System\zgzcGCX.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lgnlVJQ.exeC:\Windows\System\lgnlVJQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PiZewtr.exeC:\Windows\System\PiZewtr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kTfUget.exeC:\Windows\System\kTfUget.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ttbllmw.exeC:\Windows\System\ttbllmw.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\fRabyRk.exeC:\Windows\System\fRabyRk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CBluBaJ.exeC:\Windows\System\CBluBaJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yVOdyox.exeC:\Windows\System\yVOdyox.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KzmHzzr.exeC:\Windows\System\KzmHzzr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\SPtvWgp.exeC:\Windows\System\SPtvWgp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\UfZchjZ.exeC:\Windows\System\UfZchjZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QagSCkE.exeC:\Windows\System\QagSCkE.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fe601b6f3daa032bfc7cac3a9bb693b9
SHA106bcf05ad64e5031bff5819d1a449ec4153839ee
SHA2561ddf81048384299b1d528965a1c2aaafa5478bfe1d518cb2c801619ede20a06e
SHA512027705a6ec1a6838b98ad4372e7fc0e8cc0f31fd45076b9958f4cf0aab6cd056b26c0fd6571718f34e84ebc2b5b8080a821efca581044073061236a04a87da03
-
Filesize
5.2MB
MD55c883131b546f5ade1ff0f59d64b528e
SHA1f15873f0a1aca82d4dad61bc66c3892705215ae7
SHA2560c8e045e01675737f7eda88eec588fb1c9f721bc9b2cf5afcc96b08e9dbc5d25
SHA5125899a9bf8d3166751629d65110cb82afec26277f1143861939d88dd13a4834f6c5074a4e55a2d58ea50d3ca4f6a81d0ce0c2771ccba4f2d478a1dce6bf94708c
-
Filesize
5.2MB
MD530bd7cbd0bf8aab7c17e8ace86f69a2f
SHA1d4841f86552af48662f242b868500b543ccfc6e3
SHA256afe86a71a4f55030929f5bdb5e67e4467f9940e633ec0ca38894a1c41731fbb8
SHA51264503a5a68b278fc24ec01419924b08fc26cf2b04dc5971cb94a9060fd0009d2025dbe7ed27d43b1829aaec513a13d605ebeccf416a66ab3ac3963456f91927f
-
Filesize
5.2MB
MD527db1ea59815f98bc7d6e36a31d3b4c6
SHA129c8c7b8073fde0b04dcb157dc0d7878eabfed0e
SHA2568dae7b9493adaa7857824963f3ae7bdb74e5fc0f318dcc7c5c0e29a1016c7e84
SHA5126c57b93d8530a88bc226780f67d5db6057d98b5f183d8a9466e89345ca80d53d8fb519783572d7068d5fc12bbbc6ff823f8f19e94d0cdf6cb9c769f768c01933
-
Filesize
5.2MB
MD5ab126bde011c5064604971f16066ee42
SHA1614be9650fc6fde81f888310e0b8377bc57686ac
SHA256f9a25fb15b4cb1ebc4ff5ee252c8bd81ca1272301494ae9ff8341e06a1e0a5eb
SHA5122376715367647110419eb3c6880f96e5a4a9026125b23253f0a999ecb3debcc374b1b7d6c1ef52e6a94c9709d04047bf081407a7903dacaa10fa1c47f390fb76
-
Filesize
5.2MB
MD55b651f8b8d0c5be1686d5d47916434b4
SHA13cc45c1df44b1ae951858afee87be626aa398d82
SHA256fc8850f744343c585eaa9c2cedd614082016bfeeb36e84a394d4de5552b661f9
SHA51270f3883c0d06c524e5b04d995242c90bdfe574a1bbd8df2e08596e00303e1098cfd950c6e417f1a3e03c25d0f698609c1e6945bb6848a969b3a9b8b600b91e0a
-
Filesize
5.2MB
MD539cc2a2079006caa3c9feaf5285cc54f
SHA142afdc0e9ac990d76d7ef61831955406bd33388e
SHA2569d85fe489e72af2d3651dab50256485d550f396dcd7191665abd9464079ebf4e
SHA512c9c261be268861002dc0a29f25ad07a789f4d59008c5942bfb9c2e32f687c405543811a2ecf101dec882b52e1f409004af6c44e937f6bca941efe24898134e63
-
Filesize
5.2MB
MD5a8240d54cc8a2da8901dd584e944a255
SHA193b809e591a5f2a7643ba8f52065321a6387db2e
SHA25612cb7027ec51d7823d21380e379318badf2616b0dd23c056bcf3a332bfcc6740
SHA512f6ed3ef2a5a15775732e2646a934cc1ca20110dfc49702df7b9a61dbd8097c5eeba305adcb34626e8b2bd476be40624f3646561c734fba855eaef780a12482f2
-
Filesize
5.2MB
MD563f25570bea347f8b50106809e8f61c1
SHA1b110c5d94555d6bf7c242589d1c8c875d877255b
SHA2569e3bbb5e3e3add66663f2d4316b051d5ae3d1ac78658eb39f5dc656276e62d5c
SHA51204056a25674cb873ba9e469b14226f64b54f957c225eb5405f0c283e8a8fc201fc63791638f4531269f61d872bf4cc3372fca0072399fe7415cceac70d80f818
-
Filesize
5.2MB
MD53ebd1264b55fe562d7360256ccaa3c36
SHA1a6f55b08767fd437fc9f494e82a12a3d827bb482
SHA25686153161d813fceefd952a69c25386c91d45c02de921d8d0001c5d8f9f454fe2
SHA512becc37dd3b08c6938aba4ffdadce9cbf6b15480d30dd092872677457e4711aff717e136a7f67a280a668d11950f4665d7d42e9d91a8f1cc2322f256837b27471
-
Filesize
5.2MB
MD5cd027ac872cf668116cb214901337f60
SHA18778f2e4e217f11cbb650d66db6f8d1f679bc7d0
SHA2563dfdca1e9b0cd6e634e2d962d408ba62d9622eaeb75e477d6738cb7898486545
SHA51239dc4ef6127c841d24d02c4d18dcfc83a33fe689685ef02d0dd40840fa4860a62d4cb30f21c8845b0b8b9b56e352054a486e48743f8dfb3c573746037e1fe164
-
Filesize
5.2MB
MD585c61a4deb87fd5199a8493c57a826b4
SHA13fbc0b68a1d5e8fa22c247c69a4a156ec054ab14
SHA2562bdca3c338c3b42376ccadc693bcb9f5d55cc78569f5bb93e5af899d9aa05b2f
SHA512a3425a744c49dce5cc0045c76943945956ad525a22609c520cd3b7d0dafb7e9db6b451e31cedab0326c799a0a85bc40df45b1e3e68611805d9e55c24fd69b6b0
-
Filesize
5.2MB
MD5e704326df49be4fa655f7a1cc622a198
SHA15bc40f80fade69443a15c3256c6f99b18631729f
SHA256f7c108ee56434470c90993827cb74005b231eb7a388cd85bcccf894eb7518a12
SHA512839141984cdf1ab473bc5429857b5b9690c626ae0a5bab0fd35076ba08acdebf1be28a6006ba8083f21b0b023240c234055c227720961358a6b38e9542b98d09
-
Filesize
5.2MB
MD53600623c6d6c71f0c27dbec47765cff5
SHA1ead33c0d79bfbd1c771e25bf5aab656299e7d30b
SHA256ae81071bed26e807a90c9d1b754b9952cb14a633e9443cdeb30ded4c8df1a01d
SHA5128b2683205f834c346ce3f645290cff2542d536f02cf3b8853791a4fffc9522561bbcd4823c3bcfc854543a0b52f093d5d645810e06b30682d9ab684f2564bb58
-
Filesize
5.2MB
MD5bbfce3118baff5e7293e44a81cfc6c65
SHA15739e25b5f54d497498642232b9f4b1aebddccec
SHA2569c449473bf44d7eca3b88c49b3628caf430d8c6d2a151673e8047ecd0808478a
SHA512be3ab8e1facdb8e639fcd405d0760d6f6ccbc1b809fa4a6e69c8cb0de3875a49c3c5dd752e636667c92e0f4582a9866234dc8a594567e19ae68945bda6222056
-
Filesize
5.2MB
MD5f546f19b84e9d9ef4482568359ecf934
SHA18b28304c99b7cdb916222f121a48dd2eb53c951b
SHA256ef4226fd30b046ca8027e42cadad47a1d1f9c1158c8710a08dc3938bfd0259a2
SHA512628aa22ddf9e84f278ef95554e376d1c30b5aefd39dd1b3e27cd5a14232794460879aae37e002d4d5a5c221176428a2e262474dd031d701066351503fceb8b61
-
Filesize
5.2MB
MD5ee47f991eb100123459a1a7218ba2c7e
SHA199bb0c27c85b46bb1d07bfb276710aefe4b82e61
SHA2560aeb00946e9406fef5e6c9d45db6e9607e76ad3d8aa28f1593e12c020ca5164b
SHA512963e16cddd8c650de8fd0dad42c7828725b95b51b83e1b5bf7014639e77526d931a96f5cf09392b47d75810401dc7b2b9b0b06104a6c22db1046ff85764ccc22
-
Filesize
5.2MB
MD5a271c719892c54eeaa849755a41c5fdd
SHA1afc38740dd7eabff10f4e6796fe2d8274d50cfa4
SHA25678fad909df7d002b18cdaabb2a3f4c00f69fbbac5876fde2a0b19153ba365457
SHA5127d6ade1ec456e3c677ea9f75aca81905c8d90da31497d57a770808595a7ab18dc7d1df2eb28fc574a0490841225f3e788f87cdb4d2ba541fee6f82f9d914d7c6
-
Filesize
5.2MB
MD52f26c8e510b70b40f67b612932bd1aaa
SHA1428a7d8d3e5a04110ec9d1065a12831a395c333d
SHA25674d150ab526dc8fb79e044ef93f22680615032ff4c5413a599b63852f6b4bb5c
SHA512deeb90e3abd88898482266611098dbeaddfad5fc9e934bf4d911b895b8b0eae209aa8ffe465053553f3f9130f52035a11fe79ef61535c84ed941fbdc1c140166
-
Filesize
5.2MB
MD5079d62a925e6efcedb2ff4ce95904a7d
SHA1ecd0dbddad965fdaa43dceeec14edf828491b07d
SHA2568cefa375bdbe1839df13fd75856693fc4617ddffb53451aa66b979797e6611a5
SHA512a25e3a54a3088bced1b052fd207c0b7b0fc573d0184ab5ee3811a14ec7b3a7f7ac6b0badfc621371421df22779db0ea53185d85bd6c9872f5e249c3840e402b7
-
Filesize
5.2MB
MD55c8d2d3baa18c3809d5bcc1cf8256736
SHA1aa805614779ebc5c7201ef7c2bcf65a310a619cc
SHA256fc188407d508caf0c52f43def600c34b513e30a8bee31fba8afcb924b8e519c2
SHA512efcadeb47ed8ba6b3fd61c95ef275fc0432282c6d70afb4c0707a0b36b27401d7e8d59ceeceb2e215a35a144982338eb5e05a6c8f5063b0398b2b0967a912707
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB