Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
20-05-2024 17:52
General
-
Target
2024-05-20_2ded641c530bed74b9a94c14e707963e_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
2ded641c530bed74b9a94c14e707963e
-
SHA1
fef48e255960b4d6632a89a50e6ac9036908ab73
-
SHA256
e676a099c9b89390acbf118ef728ffde42fdc98bbd08c13a3b0b3d0d163986eb
-
SHA512
041570d04cf0a3385fd602560f6ce01d804b2a74987ddb1b2144f975c5bf181629ef708dc8c7196fff37fce78b991b227acc9ee44385f07f57668933d13e53d4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_2ded641c530bed74b9a94c14e707963e_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_2ded641c530bed74b9a94c14e707963e_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bfWrTzB.exeC:\Windows\System\bfWrTzB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hYTNBUR.exeC:\Windows\System\hYTNBUR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\NbHIokw.exeC:\Windows\System\NbHIokw.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\AUxQHgr.exeC:\Windows\System\AUxQHgr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xJbRGna.exeC:\Windows\System\xJbRGna.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\WTHdCSy.exeC:\Windows\System\WTHdCSy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nMeKMXP.exeC:\Windows\System\nMeKMXP.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\eRTRKiN.exeC:\Windows\System\eRTRKiN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\XtAbdve.exeC:\Windows\System\XtAbdve.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qciRcnP.exeC:\Windows\System\qciRcnP.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\mPPcYkW.exeC:\Windows\System\mPPcYkW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ytnYEaP.exeC:\Windows\System\ytnYEaP.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\aiseVku.exeC:\Windows\System\aiseVku.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\fNhCwzJ.exeC:\Windows\System\fNhCwzJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FOdhuUO.exeC:\Windows\System\FOdhuUO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nmNvvIK.exeC:\Windows\System\nmNvvIK.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\krmNLga.exeC:\Windows\System\krmNLga.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\AanVkzO.exeC:\Windows\System\AanVkzO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\MZnxUID.exeC:\Windows\System\MZnxUID.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kSRddDB.exeC:\Windows\System\kSRddDB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HUqtvPY.exeC:\Windows\System\HUqtvPY.exe2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dd7b1a8d4fea1e2484f051d4b5fada15
SHA1c354ec65095a7b5bdb48d37067bf5d4eef611079
SHA256a28621f90c5fb24abb780e942ab3fdf2805a97ae8170f0060633b63083d8dbd5
SHA512cda8787f4788ff8822597804ac8641e80d689ee5a7e7578b2aa4933c8526449a92ce7829e6f118864ff9b899e45b8a5cfa3a7f258ea44928a47f1199863cdec2
-
Filesize
5.2MB
MD51fde865f4285f929b044d27c5e4decf0
SHA1c3a61b793aa87a1ed2a0599846a0b99e3d04a857
SHA2561e604e968cf8d2f832a91a94b5aa4fdfadf5a395ee1b339eb019b6832b1157bc
SHA5122fbf8e6fdda67771f5676ea3d807063d0366c223b7d5fb24464518ca1f37ebc0cdc3defda49be27a905e1bc4f51c7ea77a7ed8162d0d8c8189a6c2c7fe7846dc
-
Filesize
5.2MB
MD56ef4ba54fc1e4077d63eeeaecc1dc66d
SHA19661ff85be7df2f2b7e3e1710d86b34314c9bb76
SHA256ca6fd0be4f003f47a736ddb5c745cc18e6a5d355b3d08b6583726df8d74bd414
SHA512f4b8e2ca5f31f7f92b7701b1670ee2208fb4304f2a576b9869231f40aaf32d65d0ace97788073811977bf4ff95d2f3ca58d8d04ec94c425f11f8641005f8f0bb
-
Filesize
5.2MB
MD542ab8ef8f36319ff0c8d628b4cf4158d
SHA1db694e1fd2f97482b20f10e0ec95fbb8d2a9af52
SHA25629ea69d0058b39ac35a61341188914ad12eb4284a19fa0cff9605fdb781dd8bb
SHA5123b595c35ee1c59f0bf723f6296465972a88409ef972ed843efd754905d1d599197b5d294e993298a358f12536ab3984d949884aba6c422ff34b3f5f077bf20d9
-
Filesize
5.2MB
MD5a6468dbf3f1b1e90b867b5a240c28a77
SHA163c9b1c3fc404f64d55678e7b9cb88dd81fbaeb8
SHA256b937eda108910c8fd21057796bd6e8efbc39cf5c5999090314f78c032509294e
SHA512ad0367cdaf2058d131a2da57b9c6f91a8d58984e801f44a1a4cdb46a5fc505973941a2813ed30952fe56afe9551df26f20c87be08385dfc1095eca806cd4a51c
-
Filesize
5.2MB
MD5d309783359b1656486f4686de6686d8d
SHA1dd5898176b7670010f422bd80a38b0562d428933
SHA25603ef49be5aa89c2f229e4d8b86574e2e99e51fbd65e418bf9c4f5f039a3da8ac
SHA5123a5b8de7be50e900833730ac5ec33336e49d371b89cddea1bae9eae9c8699c4f6a963e3ac3582200cf9f0f5234908f1c3f7e5c816b4766d6eeae48646d09c83f
-
Filesize
5.2MB
MD5070122f978a904916aca64b60ce78f16
SHA16907c27654dba46093bd29b24e6ee509f2c60e5f
SHA256622292f8766263a10ab9d004454d9bbd8f2b5f03544d6fc24fa825019991b08c
SHA51225ac03f4a7ebd674d8e736103f0ae7b518256971a594b84d19768622eec22f782d6f5d129df5555a6d8ae493a4a841627ba771dae1d98a86d61783c74dcb28d4
-
Filesize
5.2MB
MD5bd8a05a6131fe4ab70758c3c7c82dfb7
SHA169b9d629533acbe2e37fe30341851eea52a4c5a8
SHA25608b968724778f2f21f676995c0c4da8741315bd0e54cb702200fee2097fafa0e
SHA512b7d79b266ac84eba9764234e73396ec33147e7b8fd1067d486a81ca59b4a5ee0b17e221fd9f89a6d077ecc4957206f8e6cd42cb9ccad6466d7b0bfccee5902a8
-
Filesize
5.2MB
MD5212e4f5908883dd13701689f7da37352
SHA1288fc87929a7e4d3d04db3afd9289efc756c7f20
SHA2566a8d25647cd2e1ce06ea1fc5173dc9bea4ffe25686420e66e6d97b40b9e49720
SHA5121225825c495c9b0085c38d2144fa0e543584644b8d019468d35c306f89f4b0e74d8036dcb5ecab28e825828dc4a62f7700614dba3731a0534a1ac53c98b15de1
-
Filesize
5.2MB
MD55a869f90089c26e41333dd1ba71554db
SHA163eb59442b8b244f27446c37ce70f7b04c20dc00
SHA256286721a6eb4bc439e67483c2f7864f14f65b3e38ff133dedd5f88311ec9d1085
SHA5124adedecc01c10d54749b57aed4c432b5b784b23159560d79d7e70eff2d32f199fd982280fa28956b2f99b31a0475675d783029adc21d8dc5c2f361e3c262bfb1
-
Filesize
5.2MB
MD59362692e7ba8bfa49ffed890adbb764c
SHA1991ec1e0a4352613f76eec4b7f3a932184018d5e
SHA25609d46cc555190c8a5f83a93fa986367abfffc9f3f866bde8a740f1ca669cb232
SHA512a75019a99a14b945b88f690090ea8d745bde5aca9c87ca130f5eb804dbceff0ef305e0f89c3c17791f753a35405e2b0472418ca16c2d478511d62c18a7f0c4c7
-
Filesize
5.2MB
MD5dbb23704b9377638c01fa7488c02e4c8
SHA1995b1b2c023fa56b0799df0391279e40ab165b85
SHA256a0808445b9e0666ae2f8f19e2ce7ed813ee7b6eb10cc3f372647a3d88be88325
SHA5124f40880293b3fd16fdc9fb52419eeb214c0a202c491e95a191a50ec3648e26ed4386b00fbe599a2afff08aabfb75daeb2592c21a1f9924e927e793837ec700d6
-
Filesize
5.2MB
MD5d3312b8e28b94e48b802c227981161e6
SHA13e5104b4ee04e79fea3adc131eb991c2b2b2b818
SHA2562ed82807972c9adaecb573667385441d813070d0fee2c8cf294a1aca851c85c4
SHA512ed0e0793003b0fe00fb910e5fffab426bb42d66c4fcbf75a2abc42b2db2ddf8726f795709415176d3e4d2b43bed8700515e6806998c64f87b3c35eae4c12e506
-
Filesize
5.2MB
MD5559e88569766122d48eacde1d6a05686
SHA10c5c0677fca3b9fd3d3e08cc2c566624bc500c48
SHA2565e975290365e887c65f69226f8780a39f37cf276d2ea132ac8051b19238deb10
SHA512d02ef58a0980fbfdec344a22f6b3e7d52086e99b73e82b0590aca0bd7c9846a76171c7ec526a6855d116e5079eea9e5e02c304a4ce6efde7639628f105d35fa5
-
Filesize
5.2MB
MD546e3f7569a803892f63ce76c549ea057
SHA14004ad9ce6a358b140da7ec7d87f2bd272270fd2
SHA2560ae80f8664268a5bfc6fb9584f09feec024dcae5095bcc085c8ae13e9a1e8604
SHA5124a8f147d1c6b74012d088ce9fb7aeb412a511d3c7b940daef0f60e6c9ecd3b7232338f2eeb8118772a97a55718e27c1412657bfbc9f5b618a76e71b7ed0addd6
-
Filesize
5.2MB
MD562fc02dde6af21190932806ef16d8e4e
SHA1060cdd714abc61118f6b556dc75056fc8e0b2ae6
SHA256ba84ca1a356f36173cd074d19086f591b49adf0494b2f57861404e2c5ec2021f
SHA5123dfd599a8e2450ef54e02354ddbcc1f2b9c786ed7be5e5ff0e2be50491c1f2579ecfaee1e7b75742cb88dcedf9c06fc7f5008c959e5fedb89c24bbbd3b6c12e1
-
Filesize
5.2MB
MD56d364e78f56d898733dae2801437120d
SHA13f7ed1aeaca16a5056dae488a4125ca8dae09503
SHA256b4a4e2146d5398c2cbbfb043ce8819f2798cf9c11b6c74c7fe57369d34726194
SHA5122a6ba0307f22bb98a19cdde39b1ce20a3986f1f68ba742b7cb37a68a0a0d4c4d5ce5b9e94d617b1cdb9f4ff9797bd7f75e6ae40258d9aa0e14c6c2fa9056e646
-
Filesize
5.2MB
MD5c0a342ed1cf481bb309c41e5e6446b14
SHA11f3158bf8fa3180c9a9e299a6d50cda5d545a45e
SHA25602fe1fb4e0d7b59d532e9c8a902cfe71f6d0e75bd5ab4bd8b43a1ac1463cd9b0
SHA5123caed4fdbfc0d75f2bf92a70c04bee1a4b20b608eeda6babb4ea04ea56e68dccae3dcb2803553b7bd0351d2d2a7b1834a71dfad992a24e2a33f44fa5b834ce26
-
Filesize
5.2MB
MD5dff0746e6d71eaf8616d513a7b10c189
SHA11df79d5d54492db293cb947a25ad33e5f56a0a4f
SHA256339177461d0ac41829f7a5efa50d91b3d298f9e6abb00d51fd8cc600be2d58bc
SHA512a501dd6c8a1a0bbaf5f6eb62f6a34b912265b0e76a9df8f8f56a8e58435a22acbe0d6255d2467f3f8926d844f081d125009059505703a3dce25243e67843c1c2
-
Filesize
5.2MB
MD5fab70fcaa29d3ff9f9ddcd9d642ec7f9
SHA10c60364ec75da8203e9c79bdcfebce0a1bcaaf50
SHA256ecccb8dacaa37622823fb6d047d3a1b327c879bf5f4cb0f76ecd3fff7848a350
SHA512292f75011c9cdc62640d5bdec474c4b41e5096799fa72bfbf183e5066a60dcf5eda5a534c1b49585762053d015755722ec102ca85e68931fc658df9e7e5086ae
-
Filesize
5.2MB
MD550a0e0058d8320261e4e3466b58195c7
SHA11661e98f80dc53d1e76318589aa3b898c62fe1ac
SHA256b052196cfc157f672cfede10c961296eb0f7c2410c548c097f9a2a2bdfaccd22
SHA512ea7323b7fc94a735ae1148f40f85d26334dbcd8dd721f0d04154d98a7c92377dc9f52d56698f2c55e5a38df1ffef36b2ff13edc28796748b9e36902f80f1fbd5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB