Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
20-05-2024 17:59
General
-
Target
2024-05-20_8e3c634227dc0306df558907ca1a4488_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
8e3c634227dc0306df558907ca1a4488
-
SHA1
6cfb101b3996dc47de2d97568334a11245f256e2
-
SHA256
81e589a541c667206447663c273808799e7398eba57987bacebc9347a3214d21
-
SHA512
ba63d0c9e61849385d0476ac4f720dde382dd6791d7de15934375f600dd0c80110bc6a9b57f83fab3379a1a46ded283a3387c4419fa06ade10c1176aff2f597e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_8e3c634227dc0306df558907ca1a4488_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_8e3c634227dc0306df558907ca1a4488_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RegFRdT.exeC:\Windows\System\RegFRdT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\pffzxnA.exeC:\Windows\System\pffzxnA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\Tyksigy.exeC:\Windows\System\Tyksigy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HBfxMkp.exeC:\Windows\System\HBfxMkp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OPxVpgg.exeC:\Windows\System\OPxVpgg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xDGhLQq.exeC:\Windows\System\xDGhLQq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lFFiaKm.exeC:\Windows\System\lFFiaKm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JxNMrRs.exeC:\Windows\System\JxNMrRs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hPqcJbC.exeC:\Windows\System\hPqcJbC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\aqlNMUK.exeC:\Windows\System\aqlNMUK.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gVnqzJG.exeC:\Windows\System\gVnqzJG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cJSTOwf.exeC:\Windows\System\cJSTOwf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lfAxFtN.exeC:\Windows\System\lfAxFtN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\flRyoba.exeC:\Windows\System\flRyoba.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\MNSSKIt.exeC:\Windows\System\MNSSKIt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\psaJZrp.exeC:\Windows\System\psaJZrp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xPKfiyd.exeC:\Windows\System\xPKfiyd.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JvUYXzR.exeC:\Windows\System\JvUYXzR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IXpWbQR.exeC:\Windows\System\IXpWbQR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hkOTkvM.exeC:\Windows\System\hkOTkvM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lnWZYyF.exeC:\Windows\System\lnWZYyF.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5234cd8cb3fc08bdc707bfef77358c4a5
SHA1a7f4235c32c09d848996af14ec9c5ea45a8bb90f
SHA25653324b7224e97705af9de2dfde0ee511622f744459f0590a8fe7a993e68321be
SHA512b1362e8f9b7767345243ed62989bf08f10435182f9c83f0aabcf23ac651aa0ca96147bf27b03c14c3366e9cf0fe071d15956403ea69a0636c6b7e78f8cf950dd
-
Filesize
5.2MB
MD52b436a9a385f50c866f2f1252c4bde71
SHA10b6bdffd01921afdcef671efd0b054edf0e5a7a5
SHA256b9738b9c7ddffa6e403a2ae16899b3ba48758b1eab3aff377994b23c51b35d73
SHA512be1cc00ad0dc8181339f8a22283247d5ac1c096ced86043a9d47a8b735199a8da1ed6477dc427db07d6c41ee466bba51518e6a81855caec3b73c9cc4b15a2fb7
-
Filesize
5.2MB
MD5ebf8b2a9f20f5e6c6698a070ac422f34
SHA1df34fcdcb78d2b4436f276fe7defc649c35c4309
SHA256f26d26a82b18e53b0eddd967180ba5d595d420bd42e266c0929699af2661a9ba
SHA512c6487aea9abd89847989c0bbbe5a93030db0780041eb73bf849dabaedc82091d2579e3c4620dbd4132dc21b48e9caeb28db4c10b02dafee32eabcd13a0cb8ccb
-
Filesize
5.2MB
MD56b48c4bd99bbdce8ca25d958d2ae6717
SHA135f735d434eef5d597f08c7acaa13e1978f665a2
SHA25600fdf35388b3c1ca60ab6df9f90a3132597a0cdb292556f2898499959d75e51e
SHA51288d9c861e84e10347c4fb25b9e16bcdf17beafded1f5f42a79b7a16a818930728aa6817a9901dcca1a8ce0d7ca45bc6ec46cf10d45b0dfc2349562dee9abc1fd
-
Filesize
5.2MB
MD519feda8ea5f2034c8fe38cde95b4ee56
SHA12bbad782e5ce00b9ebd28bb6ed120c8e4d898c9c
SHA256d2835a1d0dfa10b98afbb03c920973e433a5771f0885651e132be5e1ab0f8336
SHA512cdebd5f15c25c7508f65ba1235a08f325a8c6c8f5b95a9878beea0d0b15d43c39c9103279e33257c10a0a84d06408be04fc0341bb7942a99d78ee2b2a682493b
-
Filesize
5.2MB
MD52f0d592d6b449154206d89541883dac6
SHA1d107e4e483972d4ed635df78fde2f48174f39777
SHA256ba9e4a91626921b6c2128caf6cc9735832764c11bbb05114919089f34483f0d3
SHA5125bc7a3beb9a6659d6ebbfa8acc6bfe97ca142a8c5d8db4cee399739964f38d20778754874bdfc4031bd09f5284fdb474bf6ef7385eb7d10579eaa165744e803b
-
Filesize
5.2MB
MD5fbe7857e8c4617acee4436ce310c158f
SHA1f2aeb1eb1a7098c5f1324bc81676ff86d156edd0
SHA256c1c84d6076445e92360fda70c99c8cbf359f524f204c9563b0e3823f7d2f7024
SHA512a3d133fb8de207743378dfeca0deb5aa0c1c7db9c449e6fa9bebca374f2627448617fc1624bcd054ce1905008953508e4c18a2bf66e79eb75035f8a74111e8d4
-
Filesize
5.2MB
MD5ae46a1f8ae2f4d19040678d75e5223ef
SHA1aad0eabf428e0f2ddd34442d771f37b08f8b335c
SHA2562eb4aa0946ed7abaf226fb44e79e48eb4ae7e99e08246560ca0452084dbbe13e
SHA51291aa13c5c772118a723cbfaa5a16ba847b26dc5d52b3ee70e2d08c51b4a4682d9891f0da2f604297f8508188005d35fee02d379fc59dfc27ba5490d5f8c6b906
-
Filesize
5.2MB
MD5531a27e188c828f46f1b4f04d8437e6d
SHA18e13bc26bf31ee320f1179e299932db1de023a68
SHA256600189dbc9234cd9d972a4d0e188f1b10c726fa47f901c51e269ac556e29753d
SHA5129a010d175b34eb7fe1affdabac9db85082ec10dffc650f90356ea5dbdd8e51fc3d1df2ec046b19f58b1312f2e77aaa96e18f6a82d43934eb29ddc86e63f20148
-
Filesize
5.2MB
MD5944f9d065cfd7c32008c52f32396041d
SHA1cb1467a372a6d80bb6fefbf316406340a94920fc
SHA2562ad5032a9a1916714246566ab3cb92c40726bcbeb78835e60237337ed5a56485
SHA5122a7add215dd86f9a28b6ee4f50e0519fd9f103cc8850e068ef3fa0dae83bb61b76f92ce8cf99a77e2430d936fd75e178ee9c272429312d4fba07960abaef8208
-
Filesize
5.2MB
MD51fbdf646a77d1a07b1f5048dcaeff8f3
SHA181c10874357df4f8e3079aac0d15521bc23c2a8d
SHA256e2ffba79edfb145d27b76ce0ebf77759877c9129d38e5a64a65fa4858b8d55e3
SHA512bea30e5511c1183cebf978712f819ac5ad4684ca6e430b2210a63f27b3d060d4879b2cab311853ba1e3d61229b77a208241cdf2c20a97a890e3ae7602a249090
-
Filesize
5.2MB
MD540792d906484ab2ab3b889d69e9fc11d
SHA10f44d8ab1ba90c2d8f5b59cd68a89b4c9350e919
SHA2560958f2e11142babaf8c108e945574a0a4132b472b1234f457be5f0f131a74985
SHA5122ae091acb555dcb43117d0b1bfb674d22725a3ce1a3c9b758a2ebef8b4eb553667199cb545a718ba94f35345e48003c0b7fbd7b76ced8f3d8c68976fafa7039b
-
Filesize
5.2MB
MD566a25675f6101337e3e14f670a2ba9b0
SHA178c15ab8a7909e1ae3774326fae0ed7b1a8a07fc
SHA2569d5198cd980bc62e7eb3a40db9a4425bbeb7e336169033b2c391ca8b35095087
SHA51250869dd403145fc32e71ba625e4f8ac6e88e878436d34c549144475991147e6cac8392e87650e237ff2be69be19c06fe84488b5034b13c84cd07d914cd325d23
-
Filesize
5.2MB
MD567670dd8c01a7665c8199e252291a5b2
SHA1653dc2c266086b87bbd7176b09f6f10edfc433f8
SHA2567414c61e9e7b0a47ba2856ae3e17fa7367048867594f0d4671505dca1b3b8cd5
SHA512efe1b928f407086e15d48bdad3f9decbaeb20f3e321a32f4ed9ecf2c5668d2bca9bf3cf5f5d86030f3211516ef6e92d74aa77ff31a73a6a191185da6a0410c60
-
Filesize
5.2MB
MD504e303dd49d0c6ff171fa885d72af6b6
SHA16ac0b81c29466f7c84eb660ae30ce0f6cc7950c0
SHA2568658fb4450058d44cb16841e19cd62c27292e067e31521d44e21e25661666357
SHA512ce13f0a6dcc2b450ed37ae97a9450cf6ccaefbc2f0eda8643a2a986354d1a2a2632e701bedf4ffdfaa1aaaf28fd95ba1d6ac8ac249e2dd1ebecd55d3a7591e4f
-
Filesize
5.2MB
MD56aaacbe73829601cd675f381e9ef6915
SHA14bc40cb7c29861d21b856e43e6dc328249c4399f
SHA256b369ac0b47f904c0211dedfdf8ff8301750bbebeab8249cb136a43b35e833726
SHA512afa1fee304d96db0be5b5b7542c64aaa1fe073335fed04d8ec52228d5198e2819368014092c120bfe7598c6bbb71a97ff2f60d344c6e49e8c7f2e02fe0153c66
-
Filesize
5.2MB
MD5608e50804115288e098c2bc10483a7a0
SHA182b637f79ad9cc83d7d0c374dfe24c036991976b
SHA256f7733964d4b1191f4130c59d049a73118479c15a5dda76158dbbead15e4daa16
SHA512451e83c8051c54c5d523f6fdc2b35cdbefe4f35e2e774386f6d1de3a5c1d1dcbcb2be91bd914b44707263e9e00c5663e5af29b2918067d2df3d6f227f2ffa05c
-
Filesize
5.2MB
MD5524ae37773bcf1471a944c473c5fc22e
SHA11653f1e4f6a8f27fda7c1ea07623d1c0c1472166
SHA256a7ec93a756ba25351ac250adce04cc4ec8fcf4bbabe29a033e3245b8e85a6eae
SHA5120bbf7615d36aef7a2d923935c9652ecfa5b17594bbecacba51d3ba8a60f98a1d47bfd9a42b4afb321b77ce6d9038d1156f0268953d881236c93966d7ab26613b
-
Filesize
5.2MB
MD57ddc6ca3e000377a4a5c8c41c77653d1
SHA1f7bdd3f77e757a65d71cd3a9b0c4c915be031541
SHA2568f6c655022dca782bb50f9c4144a73887efc82a3eca1e6727feccefec27bcac0
SHA512492a84c796fd3654e0b44718448452e1414a55d101b8cf44be874dc89f57903814fd067ca401d8bfff5656e3d2d5b7423978d17c3a89e8ee05c9263b8d563bb3
-
Filesize
5.2MB
MD50e443db07c9b52523dd5c12aa2c8b86f
SHA15e251135ad195d06fe310f9c5b3f8a6eb0ace1fa
SHA25655cf4db37586d32e8b3fd61883f0bfcffd0e4f329777ab0f0a92c2317db55f90
SHA512b2491973ee74ceaf582e91705cf16cd4603dc8acaf825553d933f98cbe0feb0f0b39b4635da15381d52c83ce1cb868ce4ed72d5f09551dee10dd413ff36ad68e
-
Filesize
5.2MB
MD597e0f26b3eb693c60320665873c9a5b2
SHA1846a4eea3c5083b9fb5fa249a6cc7cca2f3ee990
SHA2563cd57464400d9b557d44bf3a1f0f78f67ccb6f0a718f2cee6d16752320a8e9c2
SHA51288b1ff339427022c7ffe7af17472bc0c453b0d1df4eeaaf3da3b6ff85a819fa410a26f29d0b652ab46453a1a23a5c0d91f8b0dee3ce8a400cd4ce1b321cb1b76
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB