Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
20-05-2024 17:56
General
-
Target
2024-05-20_4f52ed49a877f185ebe060adc9bf6e5c_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
4f52ed49a877f185ebe060adc9bf6e5c
-
SHA1
45351d2d819e1da70c6d99854d78c613230b7842
-
SHA256
efc87cd611b6744e4c759195947b061abd3862bb617c47cc123a2d7c5410fb38
-
SHA512
56931ad70194852308677ade6e59972db9a0d644429e02211be91781ce20dd6cee065b32c03ff5cbfa357f4513a6106d4412929e316ce4eb247bbc64a1c8c2da
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_4f52ed49a877f185ebe060adc9bf6e5c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_4f52ed49a877f185ebe060adc9bf6e5c_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ozRvbak.exeC:\Windows\System\ozRvbak.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CxMJYlK.exeC:\Windows\System\CxMJYlK.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JFhUSyD.exeC:\Windows\System\JFhUSyD.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jIKDbzd.exeC:\Windows\System\jIKDbzd.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qPYCcew.exeC:\Windows\System\qPYCcew.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RlOHNSf.exeC:\Windows\System\RlOHNSf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BrPDKNE.exeC:\Windows\System\BrPDKNE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\YNnyDJp.exeC:\Windows\System\YNnyDJp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OyxEQUs.exeC:\Windows\System\OyxEQUs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GkDjkyB.exeC:\Windows\System\GkDjkyB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\aSsbOZf.exeC:\Windows\System\aSsbOZf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kLOYzye.exeC:\Windows\System\kLOYzye.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TLBszXv.exeC:\Windows\System\TLBszXv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nwdgRER.exeC:\Windows\System\nwdgRER.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\tuVqjXt.exeC:\Windows\System\tuVqjXt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VcJpwVv.exeC:\Windows\System\VcJpwVv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zkiMvlA.exeC:\Windows\System\zkiMvlA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LftPYRm.exeC:\Windows\System\LftPYRm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rchoSST.exeC:\Windows\System\rchoSST.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\XLxlOmC.exeC:\Windows\System\XLxlOmC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\vHyxPym.exeC:\Windows\System\vHyxPym.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56b85e7ff2e1d9becd74869b64f7d64f5
SHA1d7c6ceb4f6ba47122c7356105cd0b57735de79f4
SHA256ecc61b49e6183ada73ca844205839fc6401d3e81c2f6949e3df0846d7da298cf
SHA5126ced05c7b9e9c4270f988a965cb8db1f3acc1fbf367ff6e531dfcf506d381b4a73c12a372771c683696ca3120b297d8696aca3936b5576ab61ee6424faf0520c
-
Filesize
5.2MB
MD5a55b16ce53fa99b50087cfd66822cef8
SHA186084532959415fe99d3a032e6869bd3ef4e3b0b
SHA256cbc06110e3f91b67dca54d717ccea779299f2ba7cce0c8a245f503b310c83f54
SHA512c8e1705212f97cd5fd5d918acd3a014f608dc6660d81f8f3fad50d13657b9aa68f50a13fa4eaec8763055af7b5652005eabfa369fffc85a4b571c4c62510ceb1
-
Filesize
5.2MB
MD589e5378fb7184341ec78cbac46cd65e3
SHA15eb0d774d435eab675ab026314c55778cc19a59f
SHA256ca1fec6f45e5ec5837ea9b0237d9ca2a0bea25795e77d0c45b80ff1f1b987194
SHA512bce10b71325ba76fefdf14c64aea68089fe5b7e835d1cdb7051033ac3891a30e250aa1fab89ee69f49916c036df1ad94bc653993e692961e2d0c0c563924be22
-
Filesize
5.2MB
MD550d043355987bf58613d1fbed556e25c
SHA15277fcd58fe20f2ee5bc33ec7f153b72411f4985
SHA256304e8a424107d2d6678f2e92d32ea7d8318730ee7af337820f5177ea4e3e4c74
SHA51270cd640e30a529b682863a54e96bafd39c88946a70a6dae51b14c37938e12f42b58c5baf18a2530f4ab4b4cb0ec9e6cc54c5cdef04f4ba9fb181a0475a3964a4
-
Filesize
5.2MB
MD562ae9ca154e394f9bb2f15d14d33ae95
SHA1a08f0aec42022d932b41ce6a49be8324ba609367
SHA2566dac1b943eeb1450b54bc8a24ec49d2e85e2c977e10737a37d47ce08ed8722ea
SHA512aa957b05ead8cc608b36196e81a7fc1dfe2a7b86f473620a90703659124a7faed778bc9ee06b9163bb1f87f38520f9b7f29030ff6657ec12a2d1d34b8cdfcfb5
-
Filesize
5.2MB
MD595acee086a99a0107eeddf0538ca3598
SHA145c73ac7754cde00dad9116cf6ee1ad387022c42
SHA256c28ca03fff0c14c3f697883a34448b595ce1ce440f11af5363826f9fd3fc74c9
SHA51221ba37c71c0e34dfe7e03c8472c1489283de5bda1d874f22042876433ca3d6853c7af33464f6ab5f254bc5ecf07ceebce3add9d19450f6e0af2336e9cf2c10fc
-
Filesize
5.2MB
MD51bac241a27ae973863c8377c971a53b6
SHA1f2775bf16a9264adced3c1a96da363eb953660f6
SHA25625e949756ec5b16a7bd1ad139225f9c47c7d746894b73849ffc898446f0b9e6a
SHA512a74a6c5bfd86b3671f86d88b8a000718486b4f33d1ebd059c8301235e2c8380b7301f3bd5e693ab92c26a1871a6299c42e98547ef89e7291cbcb70a1f876e9f3
-
Filesize
5.2MB
MD5de13a0fb131bf452c554f1e404ab5027
SHA1885470b139f8693f74e08f2f3333b592aca38aa1
SHA2565fb385ff659f7c84f2350c351339b7446a17857570ce784fb0d96cb5768970f6
SHA5121023b371874072cf1b348301d90e4c6c962225c2fc615910ff9e62fd99ed1476bf986ff900e8ee6cf3c5e4611a070d17bbc737de1332c95271929abae5f540c3
-
Filesize
5.2MB
MD5213b5103279d0c6a35355127ea1ac572
SHA1c5e9acc753036684665a3bd56f0a3cd16228e8fe
SHA25636fdbc7fd1f12bb60abb4c85819f46552216ffa6356e72dd3d8f2c1ac0136d7a
SHA5123547cddc3ebf01b365a57777b6f55b81f1eee435243444ed83ad8cea3c22fca70e04a4f1e1c74dd1df8c549d4f06ec954d4fed9870864c518a4043fb488f10cc
-
Filesize
5.2MB
MD5d6d97ddf1661b64b233f28348da88e8a
SHA1f46f5f205a8f448bdfed26469b9b6defc02dc904
SHA256e529c66cab88b0e7e132d4984b66b7c4cd3f19ee59d4cd3dbf52f381c65c6e0f
SHA512cfee57f3645581ae0423c7e34c8063f7d3eb542260d8011ffdd9f25c31b907848f232aa11495579981e2d24caadfe428135f41788309daaf5884f0af2ade7cfc
-
Filesize
5.2MB
MD588685d936bbfd8f7d08a730109a46fbb
SHA16e57adb28e577a884b4985d7aa027459d5c140e5
SHA25669c797dc6e78966234dc2f4141614dd2a60c1ebc487953ee7646eeb8dba12acc
SHA5122233a27b287a08399ffd399b6c62962b719e888422db223e0c3665652b2f6f56c546bdf12e3e80e3ddea54f36fb81839d43f20eb341435711fcbd23a722a500c
-
Filesize
5.2MB
MD58e55274b890244ea4005e016beedbed0
SHA1e8fc9d8076486b8b551f5c4206086673fd1a7455
SHA256346c1e05f653862f28551c3b2d0e04cbcc5b5cb39712c05a0e01194a529c5944
SHA512dadb9fa6cd0a6591a4823c37c835b99f5dc45bb8dc542144a4499d9ca9a225f03434596a21b11948d831cbaafa906e71d9eda043089a0ccee811213a06768584
-
Filesize
5.2MB
MD501f338d5cd3b99898cdd26a75f389470
SHA10eb76c6450950151ed2286b2e8f1fe59a13d4d6e
SHA2560ed562d47f15dd83432872acabed1f88e3f1b24a658eb5671a78f97dfad86d71
SHA5120cf0df0894e349c40c21ef1bc9e8a79e2187f74398cc8cea4788ee73e6da809825eb9cc13aecf757e23c36d52baafa25768e170f4f1a14171b3eec468287fbb4
-
Filesize
5.2MB
MD5deccc220196ba1c7108d2825ceebc943
SHA1540a52b71af8240409f68659aaa9fed46cb87b4e
SHA256c5c1d7d3b88a285d887680813cca1e94f29347f68724dc00bfab4c19ca633673
SHA512942f1546c9520c6a439d49652973213a0571c390d6aeee6562ddc9e0138a543c344a43dbd6ead0b0b35fec6ef62288782763b1176a5e71087da105115d8bc047
-
Filesize
5.2MB
MD58938cdce5f5c65c904bb2b4247b735ff
SHA1ce498e90920e3c48ad2b20e0e64b5ff7f9d809dd
SHA25640d19b793c4a2286832cc9e4345a54b4d242c4b9a3a393108097006cfeb381fd
SHA5125631e533eab31deee994053d0ed03a960560b4123d9fdeae396dbcf09f9f41fc3a6175e431b255102a265b2d3ac9bf65df3fd9974975b0078c35ff38c9176e39
-
Filesize
5.2MB
MD581d8b432c7d9b11cede58d648404ee42
SHA15fdbb9df29fef2c8e1549e0fb81a592e393622d6
SHA256e4105d12179f2305c8dffb82a168003291c4e1465ca9b20bf0e19c4c9d9188c1
SHA512d08b25d8ca0722991932d7746c3b7e959b27590d71098dc3112936a931e8166897f7b3ff456b16a088ac257d0b01a8650afa1a841a04126e82ba5144a2f5d3bc
-
Filesize
5.2MB
MD56e28b9af01e531d820b46776ce03d1b9
SHA1231c50a7d82b19d8449d3ba6941260ff71483a22
SHA2561ce5a51fbfe753c11d6025cb507cfb716f7d3b5fb64b8af72bd7f7eb327483cc
SHA5127a1d4ff5005402e8efc48f43cb61bbc74fdd658bae9232c1d50da0a33ca272545cd472d60060d742537256d029ae2bec306ca9c5e13ea97e16b743ab75e2c76c
-
Filesize
5.2MB
MD567122b21c037540beee3defef787b4e6
SHA170352a7cdc298e9c6c12a39d5f970d88e2419611
SHA256764be359799decb4ace2fb0e7d5256c33454bebf529cd1995de561928d7e2433
SHA512f56355593cb114b20c9534d7c8a5bd7a0130d5402a468097e03f4a6c105100094183bf03082b07ac020687ab918f8685dfc87df82bae1cfe864f7028c8ad9974
-
Filesize
5.2MB
MD5bce18fcd7ddfc2b349030700735a385c
SHA10051cf190fe7922f86bdeb1a35600e1e41a5b980
SHA256d5f77f6d47d42d682ab5672e26f03a8125583435c16793fcd3333ee5f063aa38
SHA512163ef5da4757d31a9d7c819c863f9e3ddc520fb0ea7483ab1fa7e97628e00ca2cb074734d214172cee40f13a0db153ce645a87b5a257fd08d4bb6cc0a9a2e4ae
-
Filesize
5.2MB
MD536abcf819ed163067eeb5536062dad56
SHA18e87d141734869177551142399c59bc2d37cabb8
SHA256e29981445b4812e0ffe7ff4aa0a98fb076813ac345731bcd9dbbae1a456346c1
SHA5121e97c0340174d8bce14db4ef83a9a9fee1420e28523761206d90bddd4026858868b649e6f72372fc2609c1b07ae98b125cf8c53e9fa074756fd8d3131ccdc170
-
Filesize
5.2MB
MD559164e52a0fc1ab7157bdb35f3b9acd3
SHA1ee70c6a4e9498456b3ec7fe5db2e4dbe75766fcd
SHA256d8f67a41bea90f16a7d4796daa43be0ee2b4e261e7b6c26e7301a8167497839e
SHA512853da88d602ee1463c08ba12b53743050f7bbf76502c03993ef8e5d690e6e7b662aad32aed80774070f496d6274dc8fab427fafbf09b2705b5952646130dffee
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB