Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20-05-2024 18:06
General
-
Target
2024-05-20_efe30ff2f84fbab3245b804f15f756d9_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
efe30ff2f84fbab3245b804f15f756d9
-
SHA1
43a65294eb5ce760d92ea74519c6c8f23ade96f3
-
SHA256
d1ca88bb6b1d8d01c8b090ef65e654b66779606e322ef60527899080aa242720
-
SHA512
9e5d909525fbfe7cc56830ecfd940e628d664fb00c81a9bb7095617331eb155daa3ea377881a580b6d6366b6ef08c985e1232124fc9066a7c35fd43e08fdd78a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_efe30ff2f84fbab3245b804f15f756d9_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_efe30ff2f84fbab3245b804f15f756d9_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SxWlAmg.exeC:\Windows\System\SxWlAmg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TqZZZFr.exeC:\Windows\System\TqZZZFr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\INeBskX.exeC:\Windows\System\INeBskX.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CbeSjCW.exeC:\Windows\System\CbeSjCW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\EbiRFbl.exeC:\Windows\System\EbiRFbl.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wlyWVOV.exeC:\Windows\System\wlyWVOV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rEOedGg.exeC:\Windows\System\rEOedGg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uMLOIZa.exeC:\Windows\System\uMLOIZa.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yvRBJwf.exeC:\Windows\System\yvRBJwf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wnJvpcS.exeC:\Windows\System\wnJvpcS.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GFvDjYq.exeC:\Windows\System\GFvDjYq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hOUjMOQ.exeC:\Windows\System\hOUjMOQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qYrDwLk.exeC:\Windows\System\qYrDwLk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gKSyHzY.exeC:\Windows\System\gKSyHzY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RYydFZI.exeC:\Windows\System\RYydFZI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\WrfdpiZ.exeC:\Windows\System\WrfdpiZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zoAIudb.exeC:\Windows\System\zoAIudb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wIhLoPT.exeC:\Windows\System\wIhLoPT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\efPcdwh.exeC:\Windows\System\efPcdwh.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hTlwgfg.exeC:\Windows\System\hTlwgfg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IvXPoJi.exeC:\Windows\System\IvXPoJi.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55510e869401b86832d5977e8a01f3aa4
SHA1d285463162cda7b55dcae6fc88c78bc19c960df5
SHA2565abd16da27760ad6578bf21b0277ff5573d0d3add47acb3a597a71ca2e3c831c
SHA512940fce89d0cdf5dc36422bdd10d0ab8a255bdb516ba82e11d78262b9563fe136e08b960db1476d503b50851157654ebaae6856b8e4cb8a6a46d3156ffe91889d
-
Filesize
5.2MB
MD586677b450bb7b18b39fc27ec8c51873b
SHA1baa3d6f616bbbdba2431fb4e1ee09fd454bf0283
SHA256ae4979b089af4f56ca3ce79c8135a29159380feb1e96db6a03758b508b63b00a
SHA512fc4cf980c3b74307f857b53c523a266a95d3f5ebb9d16f85f65fcf4cb540c5e5115f1811c861979544bf69159bd8b5585edf275dc1e81a0f66b72e22b97de192
-
Filesize
5.2MB
MD53dfb3c162c37e780deec45b195b84d02
SHA1084db3395b58e009abb49a8dc48327fac63672b9
SHA25658e85de34f1088b15c11465bc928f5773f17f42a9ce1d5db2305d1757577628c
SHA51219ebbbc7ca0f18b4ef6c793cfccda48ce01c7bc815adbb5c943fb0378760a75910bb33554b52b374657ae80817a1e84b4ffd512cb0e3659f4be50174e2e6e6ee
-
Filesize
5.2MB
MD59208da1503c89925ad3329adec9af4d2
SHA10350084fc93fc8d5bf9706ca3eccb2c7dab2b970
SHA256c5ea0f66fe927832686b84c2634bfee069ce64e6803ee8efd3d2eb4cbf363335
SHA512d7b3c6906b96fdfc12f0ad4c29dc0f257ce760dc501d6cbb08c52e0480a709c25a42c2e023c613b1da4fe7ef7a2d0781719f5e7ccf4c8db35c613c3fe804135f
-
Filesize
5.2MB
MD524172b0d6815eac77a24d56eb2039855
SHA10f5e5954c9a37be81329d70b9387f2c106698ad6
SHA256759e99142a882d481611a6f3a756ed3481b797e63a5e1e4a435fc3d92f2817ed
SHA5120cd786ea1615f13c9f3c2b2254c252d8a2abb51cb785375948ca6450b7983f679e328fbef0ac1cc8ce4756d5c320f83d3e8b95fe15ce98d15c5ac644657db953
-
Filesize
5.2MB
MD56c3dfb88564fb437888a23ffd5aeb4fb
SHA1a441027dde31baf96dfb6aa4f13f5f263cbae1fe
SHA256ea6749bf60d89891fad884f8985b9b980d2f3545b056063df1c8843880374229
SHA512d54bf130eefce402cdc56f20f800c46530b75ba0ad668e145d37bd5b530e21e666776664df5831bf52c2782d7c802d8c739db9819a2effcd6621db673841a89d
-
Filesize
5.2MB
MD5d65b6148e2efc77d191a81cf84a666b7
SHA1af84e52f629a944f3ab45d97d00fbe0bf8fd1760
SHA2562afbab29516e6bd1592866cbd921fce2b536f61e90a85d6e60af2b290667891c
SHA51281e23ebf8e3f710580234873feb4345e83fd08d816270720c83a18d9ad874e44355ccd5dd3eeea0b23cba6907738a49998fa35389360dea7328c0435d7be5725
-
Filesize
5.2MB
MD5e504b57b760b3c50e1fba5353d5cd8e9
SHA1e37e59072b2aebc991925184c533ef787e84a7ac
SHA256718b53b3681a75f2360084352fa088db345bf69466c4c40df288f81315109a1b
SHA512bbfa04e9797bc0f162241c6d5ce353725dcd3a7d4d9e90da5c56e57ac389558c6459a8f02500e1bf8ce05a6516c87a893dd8658a77eebb9b21fb00b8eba855cc
-
Filesize
5.2MB
MD50728392bcc937695bb41e40b88f695b4
SHA139f8f9e323cd8ea373ca0e8693b665e36a42538e
SHA2568246ce595ff33ecd660fb38e23de83500e3d0519f1c49f80d104754e8e9c3cbf
SHA512dfac578e7b6f69cd29e3968ab247e73f97613bc323a85e7d8012a9f403a0b029e5613b769880ae04b10bb704c07f583aaa2416b0822f0081583a0936e271d226
-
Filesize
5.2MB
MD50b1f6c20db1c1002d41f2eff9e35e6b8
SHA1993228253176bbb102f736eafcee7964d0d3ee00
SHA256acf7a25e450f0cc56e4308bfd447466933bcfc874b4e9e8472d4bdf2a1b46fbc
SHA5123031cfe7e28b1f7cdd4952b6228c5248dd3c33e03d3e2accfd0dec44999f9ac84c03698965ebb107256ee398b0fe4687c27d21f5a1577bf2de67a11fb8525bbe
-
Filesize
5.2MB
MD551082ad8cdb59f12861e3fd3bd9f916e
SHA1015144610b8d2e7ea82fb0012abe5f2f26a1a8dc
SHA25618501f6b5d8d084ff0e789cead41748154c5432c5e7c1a1e09202989a9aac0cc
SHA5125fde12f497f71357a94db9da2d9f76a79a6daada0bf4c536f8df9602e9b4206a859d0003ac63c06e8c0577d22ae833d198e5377eb8b713394c396c86d5bbe162
-
Filesize
5.2MB
MD56bbe8748e58f0f0bd49c3547847526bf
SHA12bda240074864267fd3125868d5d8e4be5b8333a
SHA25699c2bb5a846c95739e583ec16f9e06df71e2c2f4135838fa5e33e325caf72f7e
SHA512ab429adb96475574fd029544bcbd6084bc302c2f5387e4f2a04a0865bc2f3f09e30a673c9f0e2a296608e7db9ee54f69a48d79354aecb9dafb47acaae1082f38
-
Filesize
5.2MB
MD5f3ca5dc507542350b291f815fd765e9b
SHA1ba803e8017e23051900af18cf0ff19a7aa0b6a8c
SHA25687d314d8b9d8f79f56867bc8853b291ab5f151a4a688df358b84463c671cd8d4
SHA51236e7b05e2c5ae7cf0ec6d1f3c3d09e0114d88a2638015cd10cf4993b03190f4e67f6ec516abfbe59135f0fc74b15d240d0ad16626889a34481bcccf4a76776bd
-
Filesize
5.2MB
MD582f1f4c4bb7afbc58043bf54d1438ce6
SHA191d6e3833feed786276a1a04e6c7ff3ede7fe9ff
SHA256e434f11bc41c1f938ded6c8b1997f27fdb3ad991b97773b4f5c802635ac48499
SHA51218299266bcf93d2a2ef9f10ab22fd81c7271e4227f54aece6b27408d7f5609ef6bd248ec0352a958c07b7bd005119a522b0770c949f5d49d92962ae0710e7128
-
Filesize
5.2MB
MD5d9b1902920c0ec86d92250ac2f90916c
SHA146e112a6075852b49409ecb3ae0e70f41428ec5c
SHA256a75a6f7921c0cd806efd546e1c877224a804ab71c182286a24ca867bece08417
SHA512c5d38884eb89e25944794e2cad618a08cc66e3ddd1ae9c63bf6eceac733b01a79f229e173d131a775543cad22090145d835c7a5b5323726bd7371d1ba5373cd0
-
Filesize
5.2MB
MD537fa4b5dc0304f81a4b18385c2b5f3c3
SHA10759a4828461e065bc137701cd0ffdb403314d34
SHA2569393656001a0b647849d3e8dd6962e3a912aebf9925ca131f916b8eba9ca55cb
SHA512f8e035618451224c6046ae4395196f70d043c8516bcafe3718c115c4b2757c09c7f0370fac72e4bc4cd1da366959a5efbac652597e0a3a68ae402b160ea6de44
-
Filesize
5.2MB
MD51cb99254c802786a2aa96977fd6ae51a
SHA1cc35df9195444158f35a3f99bc77c0b706562b21
SHA2562b00f9e7e77c9c573a7b8764b0e17d00c91641009815d01bf011d1eff3cbe723
SHA51295c483ca940015eb0d8aca46cc54069edc5e5134e08151f401acf895c0d03db43c9bb275906b8a553abd1242a5c2b6acf37833373c11afb0643fa0a131b78229
-
Filesize
5.2MB
MD5b06b0d8a8e4bd56bb6d101778fe421fb
SHA1f7dede337bfbed10ab884e9a7d76a4defd75c628
SHA25685fc3e1b73cc41e09a233f507892b05551b17683d5c9bb8c398e045e56b0ed65
SHA512fc91086b459930fc506a648e652f8d6353c12df9f8b268cda5177422e434d66cd2327f9c66989a9b87881e894bb0f5d4c22693ae021edbdc936f6842fef50795
-
Filesize
5.2MB
MD554d33da5ad5366bd789cae92b94327a9
SHA161faa67997577c180168e4310c2fd34278424c07
SHA256a3e28b56189cd643605aa371771585c99fbda52ddb704c031c9d5e21c24ae67d
SHA51263763be08258633601ca8f82c170a4f815cc1c9911aace2d4333ab11aeb8467db4e78df473fe33506adde65e11ca5b7be514e5c5e19ee6cd5873ff0976a63fa5
-
Filesize
5.2MB
MD581572c1222d9c3767567326d86ed0eb6
SHA18f9e8aa7171c7801fd79bdd47428473aefeb50d7
SHA25638c9541aa1d4ac46cf532799acf6132328bdcd469287e5e7aaa0542d49ba3005
SHA5129dec9b310ccf6b67ef51809e1dc278aafa2b5a3be48b243733e469cef1fa4d8d0ede2046614aedb988fc72caf4807f561bf82f01854c169a258fceb39411cfce
-
Filesize
5.2MB
MD5a4f3bc4273b32460fb235f60609638ff
SHA1b5653a8cf7c50eb2c025ee70322b959182b27456
SHA2566669c841dba0c1cac559c12adaf0827b254ab2032fa87f09437d6cb947bc745b
SHA5122097fd19e8915869676e345e22a194db120b339c3151da30a8d5ef515348c9996289ecc9e2831c84fb6d8b8bc9fdf7c89832f5fc5c822c539f5a78e5bc0e3ec2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB