Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 17:56
General
-
Target
2024-05-20_4f52ed49a877f185ebe060adc9bf6e5c_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
4f52ed49a877f185ebe060adc9bf6e5c
-
SHA1
45351d2d819e1da70c6d99854d78c613230b7842
-
SHA256
efc87cd611b6744e4c759195947b061abd3862bb617c47cc123a2d7c5410fb38
-
SHA512
56931ad70194852308677ade6e59972db9a0d644429e02211be91781ce20dd6cee065b32c03ff5cbfa357f4513a6106d4412929e316ce4eb247bbc64a1c8c2da
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_4f52ed49a877f185ebe060adc9bf6e5c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_4f52ed49a877f185ebe060adc9bf6e5c_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sjlamtc.exeC:\Windows\System\sjlamtc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PoGJaMz.exeC:\Windows\System\PoGJaMz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kpQzbJO.exeC:\Windows\System\kpQzbJO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RIoNwbP.exeC:\Windows\System\RIoNwbP.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GyNxyMz.exeC:\Windows\System\GyNxyMz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\UDtvbzr.exeC:\Windows\System\UDtvbzr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LcMnCDO.exeC:\Windows\System\LcMnCDO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rUguITL.exeC:\Windows\System\rUguITL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IipTwuu.exeC:\Windows\System\IipTwuu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RKUstCe.exeC:\Windows\System\RKUstCe.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xlYABMa.exeC:\Windows\System\xlYABMa.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\keKGngM.exeC:\Windows\System\keKGngM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RTRETdp.exeC:\Windows\System\RTRETdp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PBjLXkf.exeC:\Windows\System\PBjLXkf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sSGfemV.exeC:\Windows\System\sSGfemV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\eAptDxx.exeC:\Windows\System\eAptDxx.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PloDRGf.exeC:\Windows\System\PloDRGf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IcYOgqr.exeC:\Windows\System\IcYOgqr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cChBQtk.exeC:\Windows\System\cChBQtk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nvfPKiH.exeC:\Windows\System\nvfPKiH.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zBGMXJD.exeC:\Windows\System\zBGMXJD.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD556fb96dbdd0d7c910c25a550ccb6f185
SHA17e2c9a6b86fc50a1c02cad142859613c00f8fe93
SHA2564e7ba42e959619387dc1a70f829c6f25f06be50fb6d5874a1c5a3394c33552f1
SHA512ad163a4f5152ac9adc1d03b0624d0f22949022401ed3c1db25248dc67a1ebf3a5a03d1fbd17cc2c447125bdd735608d970fefe2e9c0fa8d3b5933755ebd1d341
-
Filesize
5.2MB
MD509d82ac648b1a1ae278d276e2d6d7db8
SHA144d490f9d8c6b7a1825d39b75b8df0df851aacee
SHA256586f5971657d8199ea26384bf99395f464a8fcd461861f06ad28a08fa8adfc93
SHA512f857354df30f1f0c7aac13b2566c2cf962b332bb55c3122bb2d3acfe1cb93a000114ccce18c9ca08ef86fde55c1a53620ff6ce14ec50188c015a3f9f76c36763
-
Filesize
5.2MB
MD5f3d098679821eb50657182df84bac5c6
SHA1aefbb9433b9e78cb387f85f2c13192204cc4e72a
SHA256b72044f995cc629196608a0a10833e575f17a8c9bdbf3f54fbccd582e53e33d4
SHA512466643ee224943e37fb203bdc73a828d395edc04f02ca7c2e7a1aba51ae5c3e598652fa547c7d7f993c1b56bd6280ca9f83889dce90a44958154e80ccbe2be24
-
Filesize
5.2MB
MD5c9badae2b64d45bd7fd1460719de0cfe
SHA18d1b92e3271b90ca703550428dd626a553ba39a2
SHA256275776b822ecfd5af5bf43f3702e6e93a4b3e8a7c40b95fdc2f266ec17c6ba20
SHA51282017e7bf66346891a18a5100aae23579f8dc4d9fd2d6cfeb3a5f2a46a659d7298643ad8e34631aaeb8c117470ecf0d410311a487e039befd9c341a120cd5b87
-
Filesize
5.2MB
MD53435e88cbad0e45cce0bdd1ff7edd950
SHA1cbd4781a16783312743b5379ebc084b6da65b068
SHA25681fb2f11289d7e784d19a4bce8f2adcebe9912e1f49aeaabc37e92fff022d947
SHA512c6cfd398252bb171858dea2c9192e741d30fb2817afa78a2e4b4835e4959ad0567d12148f434b462b485a9bb29c665e1a93c7a2f2811a55b30c057eb90b4db8e
-
Filesize
5.2MB
MD5013f6826c9804a78501d4f787a2732af
SHA186ad9895ad637b2c84fae7ea88f081902c6d4231
SHA256de4fa48b07712c9d55f36336b650662ad9c50441321ac6744751f7f4e3c97e83
SHA512f5adbba6b93aa8cb9608bd15f2f3df811d7b07a3d4e953727e43d85fbded7eccdbe128cfa2a4b2d474d85fe8d01473650a260ae6b546d3298253a52219dc5ecf
-
Filesize
5.2MB
MD504bf54df63e4b5100e6a16b41051afa9
SHA1685997b78c2fe3b8aafc5b043ec7bb24ba5b0f77
SHA25685284c192d5c3753dbc4b68a2f9bce692fb80deba52857a40cf880fc7d2fd1d6
SHA512a66ee5cf3772caca8827b9b8d0378cfb2e35372e40a543c42c4ce86aa97cf3296c9b73aa245b43d4fd695bd12fa88fe322ffd96f7d14516492bb0342cf7cef4f
-
Filesize
5.2MB
MD5897a2e3dcdb552e37e120b69b331b756
SHA15cb6020ffdebc3ab1749bc3213a1451610ed84a5
SHA256e3c62bc328531a0bf8a4605673a02a12a0a9e93d1301d0a36f2b510bcd04a4ca
SHA512c709b578dfacf1bde91a687d9f232e708664087dd51c4869a854f4f7c90c59121505973b4d04a2f398c44b82c2b298349a7daaa7e5fa62a0deda3db8a43fd467
-
Filesize
5.2MB
MD53c3dd225a5ccab43ce0712d562bf0c53
SHA1abdb7fcb6caee8908bfe4ca56658916c734c871d
SHA256ead33399d1a7f54826194f8453d29c3540352f9034a6fa33256fc1b247fd3596
SHA512d5d2a6f69da9847c1c677f4f6b4e1720d512e81f1f04af14bd1ae985be896f5306812cc1420abd421b7c90ecdaf07d589c7a1e60a62a8952c1bf8d4da6cf6c44
-
Filesize
5.2MB
MD5ef5bb9ed7b33fd29a11435e6dc4c3aa5
SHA124125edacf4d9e302deced1fa89a6f9ce29d70b8
SHA2566448f4a7336d22db4e15c6d9bea9f172b8d67e55e57fb03d64f339f0687ba60e
SHA512897cd1068080f4d74963d8ace607496bbd287525cb2f9f759e58719c019ebfa9e51867c57a46f88deb38f2640e4dd44beaf489d22f30c810c5f0da773ec2c561
-
Filesize
5.2MB
MD5d7da2b90356f4e32d56384a270e6f9e1
SHA18234ee8e345aa4adb3920979ea7276a1d0d00997
SHA25629b21dfd06347d80d99c86717f237547928097336fcb0af83dfb574ad249e60c
SHA512253562c8031b70a60829c48ea34525ca613513ed9fd92ccc7b9b4dd37baf640ce09a3f7161a134be821dab1cfe0f1a4c6477910cc28bec0572c265c7e48696f4
-
Filesize
5.2MB
MD591e078fd0bc267b389097200ef6e4614
SHA15e63035249a4058ad70cb115819d21ff2c336b40
SHA256bf263c29b4dd4b6bcbb1192419bf8e3c0fc3936b32772a7fe0a3261b5120191e
SHA5128e8268739ddd8e0c53622756e327695e853fe8aa6cf95cd46ea65686a9b5d9839eb12dee5a9af35dec2fdcece6891f88a1bf3516ea6d02b0cb2b54402b8596bb
-
Filesize
5.2MB
MD5dbc96ecd7eb7b2a38d3825cbc1044261
SHA1e05baeb970c2ed31a3ce2f20fcec4e38dddfd508
SHA256fdd9e252ed0e723e2b70737b803141db1fccc5adb8711edfa1503c6077d59c87
SHA51247a9043474b4c4b8df3fc3a81f988a920986753e44d98b236b7c33812fe6dba6cbca07b02ca598b1d0c9aa5915c87e0272582545995fb02222b56bf8ec2665fe
-
Filesize
5.2MB
MD5ef250d144977cd14f06f74f01e238efe
SHA1c7c8dc0be1b52611608ed6dc1de9820e689f34ce
SHA256b30ca490bdd8dec9cdcac6843cd031a48d87d6de05c6a4d7179bfeccc24d23ca
SHA5125cb072f038dc494cd06f841fc211fadd4dd7a83534cf839bdccfe4311cfae4b983812479138fa8ceb625ff74b7012c11b5063e1089a77c44ac4a559c07f82a8f
-
Filesize
5.2MB
MD5ad6033fa31de8cf70d4636aa8650d808
SHA1ec9d9ce447bb60e967d28c18a2cb05c5c285e73f
SHA2568b72e19e64bbcd0f07f4f98f9e630c2b02aec7b18ca05536ed8254a70dfdab0e
SHA51202ebabf3b4b5e5a61743ee799425f7c3b1b1899ea462eef0ccd2c9f49627a8c1c828b96a045f29f8b3e8d26bee65e973734c6881cd07936e8f1348861ac2fb5c
-
Filesize
5.2MB
MD5c8d88dbd879a2bf3462f344f75084969
SHA155a3e640c6e660aae67fb8732399c5281560ed1c
SHA2562371f36dd782e703a8eba020c59117318336f6856bb3bbcd104866d5159dbccd
SHA512d580d1a4ca327ec498aecf0ef01dc9208340bde3a30e7a35d2f596e5495a9a60411cd7d628793cb6e646cdfb2294eaa22ad85004266b22aef4734008a8d63035
-
Filesize
5.2MB
MD53105d2f92e02246b807508d0d7c3d134
SHA1e71a4eb98be49269d2df839fd4a07a1b7cc78ef3
SHA2561b91ec8cd4932a59e92188632117f6fd1f9824306e0649370ac9f0cf54acad3d
SHA5122af5ff7c81f05ef1f1750232e159b3d4a7d26e2f9d4db64a54170d2bae5b7bbfd6f94e5d4aa9cf56e90ff4d3726d6af58cf5336975bdbd9e1188551ed759220d
-
Filesize
5.2MB
MD52b22c8926fbc41fe98a780735841065c
SHA1404b8575b12069022b4ed128f0f1af5b0bc6ecbb
SHA25688301954ce59940bbfdc73d28a38f3e4802737470ca0b55ebf5323426a2190a0
SHA512aaf48672028a0dc5cc5c37518f092d2315490974980622861646b96e9cc4f0b4bafb97e7b3e217e8ae9ac205b2e9818c90ab98c357f265e0ae416e6da9cb6a24
-
Filesize
5.2MB
MD505deb873283787348e8bb755db8ade1c
SHA1b8f13f55a8eed83222c502918f369661ef71ca5e
SHA25633148aa1e6a4ace4554316463b5226c220917a478a3a2ffb94aceeeaacaf0de9
SHA512a31608a75d5b0c01b6664e3618667f5a1219e3f0ba736f2a556c3eb7bec739577384ef0f1e8f6b5ec1cb57ebeec5faabc6095ca56f95fe4354151d105f263abe
-
Filesize
5.2MB
MD5d4139053dbf7f5c5566484361a84a745
SHA16e96df120dad6139c019ed36a55d84155acaa218
SHA2567d26f371b913fb1ce85b3609b5aad5170048dd66ac14c867ba88db037a227032
SHA512f775cb2d1d44773336764fb77e9e6ac5334e22385ffe83590c3d8bd9e49eed1167114c6959447a4f20673b18476c6648408927c1fb8f412d37f710644e0fa588
-
Filesize
5.2MB
MD5d322e5243aba2208cb14bbb5239bcbf8
SHA174295242ba0f40f8fa55d765850de0c2cbaaafcb
SHA256f75a6fb8a5bd846223c6bf753b86f9da8d021dd9a7b17ea56c4701cab80a7153
SHA512b8f0e5c1267ff47f9fe6961e62796042253f34459af0fe80ea35ebfdceea156fcbd7aeecc30bc1829ae5c5e41c1c9fca0ed2e01fea74abd6a7bad19a0fa7cd91
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB