Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20-05-2024 18:05
General
-
Target
2024-05-20_ece0c0ed1f879feceb90e1e7e9499bc5_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
ece0c0ed1f879feceb90e1e7e9499bc5
-
SHA1
6516a5c1d0b4d00465532c8d84f47c917eef87e0
-
SHA256
13dfd72e64b69083fb2ffe8aa1bdd77e86d42a64571abcd6ca15341b6ba78292
-
SHA512
457629ac9bc2336e1cafa6018e6158861e8849241d0e8f8d71ec5435114797790d0122b63d22b71299fbe6026bd62791d1fd49e3600ffb8f0b89c685383034c9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_ece0c0ed1f879feceb90e1e7e9499bc5_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_ece0c0ed1f879feceb90e1e7e9499bc5_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rwHxlxC.exeC:\Windows\System\rwHxlxC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nrXairq.exeC:\Windows\System\nrXairq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\XMuBVkN.exeC:\Windows\System\XMuBVkN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\iofNCyc.exeC:\Windows\System\iofNCyc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\oyCkHRq.exeC:\Windows\System\oyCkHRq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\DVfhxRd.exeC:\Windows\System\DVfhxRd.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rlLNOSj.exeC:\Windows\System\rlLNOSj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xWZAued.exeC:\Windows\System\xWZAued.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gyvqPZY.exeC:\Windows\System\gyvqPZY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\tdWolJW.exeC:\Windows\System\tdWolJW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\mhyYzEs.exeC:\Windows\System\mhyYzEs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\oVrCZfB.exeC:\Windows\System\oVrCZfB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\phlVoKL.exeC:\Windows\System\phlVoKL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\pwaakFY.exeC:\Windows\System\pwaakFY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lxCpuyS.exeC:\Windows\System\lxCpuyS.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lrSYntb.exeC:\Windows\System\lrSYntb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gkNmKGU.exeC:\Windows\System\gkNmKGU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sQijemI.exeC:\Windows\System\sQijemI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\YTVFMgn.exeC:\Windows\System\YTVFMgn.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wNcGrCx.exeC:\Windows\System\wNcGrCx.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rdCEsGt.exeC:\Windows\System\rdCEsGt.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52ffd54694f4221a01e304e0e5027de2c
SHA1b0964c697f8182ee2a4cf582ee58fecf7106ce6d
SHA2566223100e032f4227c25e60673305e7c8a5c25650dcc298f8646943e8c8d6ce91
SHA51225882dc767b43a0ad5212727dbf25613adfca2a64841b13af72df084aa381fc1b728f44778024cea99c9e1bf922bcffdbcd1e28a63a56a3b273585ab9c12074a
-
Filesize
5.2MB
MD5c600abea15d35a00cd44444c082d707f
SHA134d0a2d072b2098cba4f02dc0b4af93507194813
SHA256a65079776dad78438dde465824cfb09e2902f1892aaae3b12227474aa7c82530
SHA51281c8b4c36c4569425d91c9273eb9a0b4b016965677bdcd9ed184a7b58fbcb87e4649a31d82d88584ee0870cd56425402db75845252fa99b061e1e57825f663b8
-
Filesize
5.2MB
MD5a99dceb4d4130c3ef2745618ad1e16ec
SHA18c04eb61bfcc5e51b169f3bbbc864d7fc8993f6f
SHA25608c57b428f32550bea3472d86e6ba21e875264bd398bd81bd9c380fcc271ec35
SHA5123bc58a04b22bd06d40012e14b35e22bacf849c80df9addc7939ea37692dce717a736e91d48db5c288ec9177da3276caea03f6e2f5af4380fceef24abfe3fb9c2
-
Filesize
5.2MB
MD51ce8d1836c09592ebeeb979c39177680
SHA199e0266c2ba24acfc0224d7e108a436b35f31509
SHA256f11a783a4dd8b63ca1a0f704c7bb72dbdec3766b108295c443b2656475889cd5
SHA512234588030a610d6aaac0486f8e4c093e7828f5155177a9a8e348467919199329e5d4ee9c286c98cb84a1f2a577a6e5ff632c2969e8108b164f51256f336a50eb
-
Filesize
5.2MB
MD55947cc3e1471e7f9e32d85d4624f45ac
SHA105219b1f68244355bb475619eeaa4f77e2038b4b
SHA2560bf8c1784a6502f7476f8ba05336978255b46c3a2b99926b790618bc50fb632f
SHA512b6b6acf06707a73d109f7b91b38f1bd6f92e1a793693ec2ce995816ef818a65e6f1c8d1bd35e44730d414810cbf5f4367ad147a41a57c4676ef26851b6fcf7d5
-
Filesize
5.2MB
MD5d2c2dc8954b2538dfab811b7e1c33d10
SHA11948d8e0946d602529ed35e9c104c8e44ebdef6a
SHA2568fa5755d49b5665f374b2eb32bebe3c4c472a76fd9fb506943d433dee4ec91d0
SHA512bc32678b3a89bc2513653b5613c6e0d5e3d2479a1f82f10a3ef78948ae53dc7895283cfc745501d739c8eb63fc4896761c5749865190c10717af3c78f72ba0bd
-
Filesize
5.2MB
MD59db894890ba36681b1ff015a2b4a77dd
SHA16262572eec3ebe704d9bf95359dbe5bceee16827
SHA256a28157889ef200555822b021da5817b184f7a673bb8ffa108b644adb43c74766
SHA5126ef5b62ecbb9f2e8cd86d87b6df21d15cd1d6c7baf2c6349d5496fcdbba481989975c6ff2f1cb208cb4b81abfb6bbd82d7e83c988c1db154cc543d12a01986cb
-
Filesize
5.2MB
MD5578db64aa6ca060fc122c55f80e8fc70
SHA10df70ba43bd7af55eac5ffd0b0012be6b82ddfed
SHA2565c6b09c2def8d9a25550ad4d73a8810c86df931e6a97e7bddf80d167bcf18ab0
SHA512d2c1ffa854223599ff83b558e1b2e9de2fc38cd1526f141d1fca940669fce129864cb0eb6adf4e8d33a17f79f50682eda36a13d67f649da8f66b0367e7b0bbdd
-
Filesize
5.2MB
MD597821554b48e6bee7b33bbba1dd92f55
SHA1a44fc25418660ae49abff15a03f9dfed29c68a73
SHA256b2cfbf3e80a287b409b1a23669f1ea0693f11dc70854f76c6b35108e8fb79381
SHA51248c12570fac8cafd1e328a4b5832622c47e63c0dacefa4e8d2ab695dbdda8887698fb3b2152cfbe4db2dfb1f61026fe5541fa997ab7f1ff0da822b0a659503ff
-
Filesize
5.2MB
MD58578b47cb80e07a4424a6d397c2d85c2
SHA13af095cd7871a5bb8efb2cc2349a7e2cac67d8c2
SHA25640206ddf8ab740fb4b3f70ce236dc11d3c750f34ce4abfcb4bea83ac1d7e2e45
SHA51277ebef857c4e65c5e046269a8e546e0eb584b77ce9c5bac19bf83e4fe3ed11cc5f27cbfd7215d7e6653434cb22780a9656ab97abc7532f240b4b59202334c167
-
Filesize
5.2MB
MD59a2c97a8165540a4c6a45099a3f4b81d
SHA174bf48aff095e5dadcb89e210b9dae121bdfc49e
SHA256f056b3eb93dc072b1657a703fe11fd4342ff56c6bc697a46b6758b83a6b8cf0a
SHA51222d6317cac6a7efcbb9ede158a10f559786d74ae5fa2e43b59412e5ddb020b41d52b887eecd24278c785ad6a6ec285ee31766edda578c9217095a241976b81c6
-
Filesize
5.2MB
MD58094fd069401ae094856412bf795000e
SHA15ded3cac959ca7bc99f9e80c1bc3f6bf875039da
SHA25665cba3c6cef3018a76a4421d203cd409ac29da51c8f2e65da5cb2f055c3cba5f
SHA5122967ab8f038e842ac615b7db9a0bedbdf483681f7d89158410cc3dbcf9a203d02044e376d220c4e770138afeea42b1bdbbf5b61db6f921a06d5475a2bd9d8345
-
Filesize
5.2MB
MD50ef995a9bb0245f70d99aa9b80e5d899
SHA18b12739be806262e4b73a3cd37f3e58a75609571
SHA2562a776458b58da627256a816a7e75357681a8cb869d65fee944aa1998f92fdcfd
SHA512c00fdfc094651f664aaf345b515cb43a4435280b2c81d2b40533124e4a7dceb86ca10a92ddd6080a5de3f5e9f3012f3408fbf698b1304d4b9d321e305e322b3b
-
Filesize
5.2MB
MD550903a251e6f751595a1a6209dcbb398
SHA1fc4e4fbeec8f83c5c9c461a35c806c4b5e57708e
SHA25637eab7633b4694052476d565f8d80c9b76c9b6c40ecdd06cfa5b3329fafd2fb6
SHA512c2c801ce851b7787c53fa8f3a2541fa7403231ce2e9d680818acca27c9f1867e9f6282c8085589fedbe2de0f3ded200fa328661e4dd4155e3885e9609f160a33
-
Filesize
5.2MB
MD531eeb647682d9bbf3bb32f812afef874
SHA1068eda2cf36c2e6bcdf71b641312b32501abf389
SHA256ce0c91db58c710744c1131dc5605087c5d13da6725c92cc1e966e709202abf2c
SHA51221b9c4ad952354c934bbb86c7d3ecceb5bf414f0f9a8f3ef373d84ca50adf32ebb1352f51674a86590c4ac71448ecec7b45202000ed21aa0d51325086d40c169
-
Filesize
5.2MB
MD580b2c8c880dc3e0f9c18d6db35fc7ca2
SHA191d159e9797ba53d8360308943fc5d9750ba3a28
SHA256bfc387f853b5a16b1bf9c8cdbb5e5b5c830be86ebe78498890231d3c48130cda
SHA512bec2aeb0aa748de3b18437aee0c0df88c995189b9a27ff67411ee410cdbc8b03d8938c6193b1cba28e480e28768148c10de43ac0ea4b374c20c4fa2b1330f581
-
Filesize
5.2MB
MD56e0cd2343c0e97413a9a6badd9035bcc
SHA1746d18a183848e5a08eef3dcd0482510f97a0c9f
SHA256ddb346e96d7cbf3ca115b2e2c7f404359dfa09bd3fa6d5c5c0fbd0e3f596a7f9
SHA512e0fcf34700191a1fc06e308c9e930e9f5d3267b464c023c522007bd28040f20c62dc7501dbd2a2600575825fdb1a59d6e08012731d86ef3ebd3c6abf1368abd8
-
Filesize
5.2MB
MD5b7f22bcd4a17fb8317955c2a14dfa4dc
SHA1700d035f263ac4963b596ec55bed4ecf52e298dc
SHA2560b8e83596089a5c787f03e2ca33ad7290793c159ae18c64bbd270d15b98c9fc2
SHA5126151ed6d344f50b14fe6509164fec5ba7361ce0f36a45af998384c4a6e9b245c549e9e179a1e7a7a53493076972be7ea2f468ff6bf4e43ce0e5338f3899a1dee
-
Filesize
5.2MB
MD5b079535cf0600b99f48f8ad776f95430
SHA1ac8ff4b021dbebdbf314078303bfcd08ea11017f
SHA256848cf8ccc7b6bdc8389bb966497688c63bef9ba51aa4af8ff671375806179947
SHA512245e9db64151e54a39bfbb835fa9c963801e9f9c667d655a03b5f1d2bddbbba6269320c7c5a4beeef862d71401d91be048bd90fbc5aaa0b765511c76451c87e2
-
Filesize
5.2MB
MD574da68486074963368a126c73692d600
SHA186b8d86c56c8429ef3fb849788f116fe1032bae4
SHA256f6d7316072f8fa0333ae47aadb81cafe6cdfd564cd4b72c054cd92f7b1947fa9
SHA5127eff4777db663443c028475675ad7fd7b2c404e50b684f5f0e49aea35034191f5c5259a3e0cc7f87764b50b84c76640801596b6169cac5e14b18dc1a06962b69
-
Filesize
5.2MB
MD5acfab0ffc3bf4b00d221c702d8964035
SHA1ea117e3095ba03c09970a66dda6b6369b5520020
SHA2561b3318eab1e7f76a43041e18949a7b2a2e83aecf43462b304a977a61bf6734c1
SHA51287750632c945d17e1c7b432d5d55184e0eb1b769036e061dea77c1b82746d8c20cf9be46c900e92357bcf6033187d8b205834234592165edf5c01ebbf89f5506
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB