Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
21-05-2024 01:22
General
-
Target
2024-05-21_35dea998155a67464d053b87b0529569_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
35dea998155a67464d053b87b0529569
-
SHA1
2c719ed8e75e27eae732db986c3ccb2ff38a4724
-
SHA256
b4b402e0f7640b81947e5f1684c6204849df5d6daace2f1850b40e2f037134f8
-
SHA512
c5de200ce92e5ccfb8e8300904cd159c1dbdc1a426e56195276800f75e1df022e789b690e17c0f829a77d1c250f8d215ea92158be00a6be4545784f2ba2d02fa
-
SSDEEP
98304:demTLkNdfE0pZ3656utgpPFotBER/mQ32lUU:E+v56utgpPF8u/7U
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 57 IoCs
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_35dea998155a67464d053b87b0529569_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_35dea998155a67464d053b87b0529569_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DxIzaII.exeC:\Windows\System\DxIzaII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIzQXzR.exeC:\Windows\System\mIzQXzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgFLSaQ.exeC:\Windows\System\VgFLSaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtxzdJB.exeC:\Windows\System\YtxzdJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCKOZhU.exeC:\Windows\System\CCKOZhU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zKiyfMX.exeC:\Windows\System\zKiyfMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKybwcK.exeC:\Windows\System\HKybwcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NOcsSBQ.exeC:\Windows\System\NOcsSBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtNrVTn.exeC:\Windows\System\jtNrVTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNQewVI.exeC:\Windows\System\JNQewVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VuIueoO.exeC:\Windows\System\VuIueoO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vKpMymg.exeC:\Windows\System\vKpMymg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZgakzTq.exeC:\Windows\System\ZgakzTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRSNbKx.exeC:\Windows\System\WRSNbKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cYNJmLJ.exeC:\Windows\System\cYNJmLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ckzDmLO.exeC:\Windows\System\ckzDmLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wuyrqnp.exeC:\Windows\System\wuyrqnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnBwXMw.exeC:\Windows\System\fnBwXMw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ffyNvqk.exeC:\Windows\System\ffyNvqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mjRWIFL.exeC:\Windows\System\mjRWIFL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrxttvH.exeC:\Windows\System\IrxttvH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD5113f5e82e776c62c95d0185a14c8631a
SHA1813d2b3259bc30d2dd1b655fee35f7424ea2cf42
SHA25652add01b6daca54a5a593fc86a17657e1704b80e723f9efe193c2c503d228c80
SHA512355bdd4a99d4d620753504a202fcefe74adc92d4424847821c9d6c928a90337bb77e144c56d8864599fd9790c8a967c4b50c8a27ecb385e5da3e0962d32a6430
-
Filesize
6.0MB
MD54300d8da89c5f32b8ce85daa9d2b5184
SHA1c70034527e81cc1c6ef7d457882319833d730d0d
SHA256f008d7b06de57fb463054c654e1adf6c2fd6fe4151e9094566abd8cd75b99879
SHA512d25f14485909b4b6575fc3a2adb9c404ea0fec588d8a770b935eac549edebcddbda9bdc9687716fb88d39e048e26b93c05943f013bd7432abea310b9ab066e32
-
Filesize
6.0MB
MD5be0a026f538ed0ee508623a6ce869306
SHA1a2b97b219547529ba3c9d8ed43ac6f8f229c469d
SHA25615908e51589910930855fb401a30af7e6c37126c2b4ebcd65928f8ce110c485e
SHA5129234135a5887324b831317169cc288a61f6810d35fd5bb688910b4da710d68834bb551502f8e6f1b25ef36d964b7886c1f843797ae057bf0f9077afb686aff07
-
Filesize
6.0MB
MD546a3c2b142926598121679454f808348
SHA1c1f62c42ec616f7cebcfb786a421c731e5213132
SHA25651333562ee088d1e5e65648169f68ab4ad8bc0b240f93a8c32a942470763d5e1
SHA51239d47459d76c69fa439567723aee892f932b2b7da86ac01d2bb1d9ce01f981d35beb7d05aed446f33503f27cbf64d582944ab5de5fb322fe68df145a829e7c39
-
Filesize
5.9MB
MD59efbca84df6d1084dd149e36b7e20229
SHA1714735c167eedca79506d10227f4ada2da5b4e26
SHA256e5296df7e867751e69ebc545638287c221b1f659e4388598729c684a85cac3fd
SHA5123d2ce795599c5874b3266a430593a8abf30cef13268eb7de1ece83fdb389ee7703cba6a42837605eb45fe894b061e8fb9abf4a439ec3bc22a6d7cfe7e860461c
-
Filesize
6.0MB
MD5a5cfbd583fcc8361f9525d751b138df8
SHA1aba4787d37c2496693b99642f8c97366c3b1fa76
SHA25622cdf76c860f622099762c8ef7a5630bf7a5c4bf2a242675fd0e1ce4faac2e36
SHA5124963a7bb30e194b36ff98d49c150803387d27b3bfd969b96e9c17fb81693bb20e40edd9c7d9dcc69790df46219f65c7cf1cfc31979ad8db53dc765463ddb019b
-
Filesize
5.9MB
MD55c5c7edf0e18ba6b7e1d0187f8da38ba
SHA1fb5cbecebd17e87b6bd67b0bf078db5c6adc5e71
SHA2567fc637a12cf190f898ee408cd258a3abbbee19b75d77e481c2d7a6bb46db4d02
SHA512addef5ca00d383f0be0f28939e3c0338eb4fe7f3d850887dd2075f9bff75c5aa670fae92c10bf51a8fcba42829ad2f0d18139e7270adcb76a96da3fdbc1ed518
-
Filesize
6.0MB
MD5958b6b34d2f797748c09b07d4efb06fa
SHA16f5525774d23203f7c94f862b9d51966b6b4c6c6
SHA2566fa8e32b3f9679f00c12d834e8e5379c6a9e501ae29931d36cf06f6fab9d8197
SHA51235445a2aa63457abb1db5fcb510f951c8df13a76e61c7a8b4557be3de2d3fcc64ba5cb19d1666b20eea95c2059ec3ea673d7b0657d5f53cd4a2306518601a2bf
-
Filesize
6.0MB
MD5a967a5357417bb109cf294b906196f36
SHA1e915259629250f0b1f97ba6378bc98aff29865a0
SHA256185d10d5282d45b9bc6dad87d0b5b02445a2b0e2e212f64ece1e2e37438a0d5a
SHA512b7537a09fbd119e3983e3500d659f382954e6850006473671fda83e07d79e8e44a4d5f60894dd1840392a23c19d13e552c9deec3f06f532741a5951d90ff626c
-
Filesize
6.0MB
MD5e96f9a84cc811b5c4c207a58b09f67c8
SHA1848692c18410c82abb7b68d24da3579dd6862d23
SHA256b0ca8b7674e1ab15ac7d2a737026d480c471f67aca724da08040c8be4812e84d
SHA512de6023ea3c83735fb6aecf2b5eea4ab12762e38e50305d373d54f1697e192019688afcad4e0eafa6bd23b37f6bdac79277127c4ef7e06f4c5a6a3b60779fd8c0
-
Filesize
5.9MB
MD5de182cebb706356ef50cf98a3378169e
SHA188a419b2f857263b4862fb1ec0b8ae7ff756dbaf
SHA2568b899f4d1e27b7f93ccc5a2ab586b395ea13d2aa90449ede75aa475e4a483f88
SHA51217534a07a079b32255519759b85036ca2f20477909bd79a07fed0fb1d0ca4e879ea7fe5ec7ea9edfa9a6cf870ce98499dd1d048f1d2f9fb3a4df7ccd0ba1765c
-
Filesize
6.0MB
MD50a6cd5c728ceaa57952f80d2e20988b0
SHA11754305e3fdeeb80c32954c2153ff527892a0708
SHA25682e41bdedaf5393f5e49c14355574751d07be4ce765d537f0dff1e35f64d0389
SHA512013e76cbb48caad37b079cfdd00b749d46da2de4e994bc2d72dd8f62097b9820d53795d01fbcfaef53c09b94a13b934507a21f367a3db5925cad439dcbd54314
-
Filesize
6.0MB
MD5d29494d245a497ea4287e09e13272f64
SHA18496c6da8cc2b0b560ec94b1858046d5bbf85fa5
SHA256aea7099fb2cdae17cc3354bd9388d432ed1c92826aa8a24aaae54ae47361f6c4
SHA5127a97d273df86b6bc13a15af8c394c772e80f53f2d5eb200c3dc26a4667016cec8920d17baa40e3de77b5d56d2a51bb4c2c572ac2ad548c3078c59d27c6d43131
-
Filesize
6.0MB
MD5314b7649c0a8571144e39e3a054fd47a
SHA1391a431bb2ad49a11bef4348fcf5c490a7c39b13
SHA256ec99478fb90f3227fdf20bd784e959f7ef3bbaf7a94fdd167c6db97c9b110844
SHA5124e5aac264c15afa29d447572c391bda00bdf41097ac6c33658e04ace1e94d93a5e5729c1c6372717ee899034ed4034a122f907aa97e3310668449c3ebce4b7af
-
Filesize
5.9MB
MD56186226aa28d004d5926da800da54619
SHA13b1417318d018edf7e08ae2e35c7f68883e93cd2
SHA25676a8ab25e057c1d156d67a20ec1e75fa94596e34bcfa96df4ca451f2c9822af7
SHA51221ab075192fc05d015abd726c72eeba3d9c6133118c687d5b766a2b7f676b8925c745e6212db928b77ea8261f6b7bf0fb00ee64a56b745b01e3950b6ac453aab
-
Filesize
6.0MB
MD5786c3cbc9715bf25aa8125fcbfc7d725
SHA182181e23b93a6b0647a5df064870a5e95985ef72
SHA256c440b42841fd68b54737ac50fc236f2abf1f53e820363aa4f24c6d77350c160f
SHA51286d7e04acbb1593dc626157da85508172a33ed3af65fc1bd5d38545ee84aaae5d512160b9e94a05761ae2c8532dabdf968219a71a554c20f067a8887bdd154c4
-
Filesize
6.0MB
MD584612db5de0208a6c4a5a0cba6a1198f
SHA16da1a303771deeca0d1981ddbfd45f491d87dc11
SHA256b024cf2fa288d0321365cea8637bbcd07df56dd909bb929879cad5019e2b3fe3
SHA5122d57898a7cedd8be82cc9a66f5aec6468c3abfa12098fb543810a89735e5baff7b6b99f4f229cedbdf5a4be1eff8643aa7caa5e46804d6ff8046fad275cb2477
-
Filesize
6.0MB
MD5f3b33560a37599fe74bb4d0b494ed285
SHA177700dbe118705cb5ed52b6852662b60dabf38cb
SHA256f87df1ecd06a789a5ed20b8fa07400eb273f8dfa402e41bc4b147f605e96544f
SHA512fcf06cbb9d7933e07fb9f5a95c2883e9bc918c6b34feb7451331b531603437bdab762205c374509425abebb7a29d987be7367004741a01ebe1c964fdaef4a93b
-
Filesize
6.0MB
MD5d461e8d9a661fa14bf2f2516070dd075
SHA1c4216d676229a034d284d6bee132cfd0e38803f4
SHA256ac4f38c0195dca3cbc9b94514d9bd6096bfd9e1ee40ace68150073871f7f04ef
SHA5129286813f90534f85c855749fa46e2d900e437f15eed108daf4b4255d59a9bbbee8abe0f938309639c89b525405ab58573dfed9df8f9aa18e45bc758dbbad330d
-
Filesize
6.0MB
MD512b9318a2f62c59b18c791bfbeb8480c
SHA1e6917a5af0ff04009949741f182660847b73a28d
SHA256923bc6be908580f9305a779edc8f74438bb9d6b94eb760a76e99c9aa7993e23a
SHA512958e76d23ff2e5bce5af598f34ab8c11da6493e29402a48e9b1dbc351563e48e0c4b8a5c9917fe595e5d614ddbdf485c44ac7b3a7ca30508dfa48b85360e29fe
-
Filesize
6.0MB
MD5f8e61f551382068fe46aadc069e2cef6
SHA1d3b6847726ef0040b43a4fc0dcd0bf64b5ba598d
SHA2563f4f901ca06dad129df86204b7b866384f8cfa6606fda6c26d0e7038d39870d0
SHA512d4577bcb4b6f3c8d148c50af55cb0256e47e24bcac53dcf17ebf0a3fc4a21a2377c866e0bc6881fdec468599343ba65370844acedf758d6693642644efa513b2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB