Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
21-05-2024 14:47
General
-
Target
2024-05-21_a22a2fe878952d00322a58d3e0681f08_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
a22a2fe878952d00322a58d3e0681f08
-
SHA1
272868fb654ee7bdefd92e3137af5db1f4b77803
-
SHA256
7a0bdbd07c96cb478518ff4ab48bbe5c5d7564ad2b795120f5fbf19266a2eb90
-
SHA512
7ff23ed775aee06f764da86c8529a45dfabfce5c1893ee608e61c41b72961e319d43d76a6b485d1b3a922d4c57b4be2e0ce52226044c76c4ad71328b6cd13196
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU7:E+b56utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 61 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_a22a2fe878952d00322a58d3e0681f08_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_a22a2fe878952d00322a58d3e0681f08_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UbUbfbO.exeC:\Windows\System\UbUbfbO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\WtkrWZF.exeC:\Windows\System\WtkrWZF.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gWqKCDV.exeC:\Windows\System\gWqKCDV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\WsOCpge.exeC:\Windows\System\WsOCpge.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LDwUbnv.exeC:\Windows\System\LDwUbnv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GDMGEsR.exeC:\Windows\System\GDMGEsR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cuCuqmM.exeC:\Windows\System\cuCuqmM.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\otVanpd.exeC:\Windows\System\otVanpd.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\UfKwHOk.exeC:\Windows\System\UfKwHOk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rzUqnTi.exeC:\Windows\System\rzUqnTi.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wKzVFDa.exeC:\Windows\System\wKzVFDa.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\tufYfTO.exeC:\Windows\System\tufYfTO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\Motgcdc.exeC:\Windows\System\Motgcdc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FXqCZzm.exeC:\Windows\System\FXqCZzm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\EPjQTFb.exeC:\Windows\System\EPjQTFb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PrQktfo.exeC:\Windows\System\PrQktfo.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\dmJWGEu.exeC:\Windows\System\dmJWGEu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\skJegAD.exeC:\Windows\System\skJegAD.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RgJkmsA.exeC:\Windows\System\RgJkmsA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\smXdRNO.exeC:\Windows\System\smXdRNO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\EmqbruA.exeC:\Windows\System\EmqbruA.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55aa38c998e25e6f86526d53de86c9d48
SHA1d96da1c1dda94e4475b7064d4da25067a0c33e60
SHA2560a45701e066f45619ed8387c10614bad3cbd904a05e18280e2401b35d480188a
SHA512e004afca2b4defbd0dd19569a7110c751db59d8514765c6f9e78dcf70a762d8548fd0b6dfb648a79b21fe07c69c83b9b2176ae065136fa187bf44daadd532a11
-
Filesize
5.9MB
MD504f1a808cb3b59710246c93292dd1ea0
SHA1c30496e4659e2a6adb356b74d2f58bca4389d8f3
SHA256d6b414d05153b4c07e9a425aad5c7ff27c0ccf642c2ef0154c0fb541b8602b51
SHA5126c1b19e3dd7aaab496ea0c30cd1f7958c940dcd0fa9b381d235083b709c1e29b43e26ac362965e7f5755b924c1b184b486b7aa65e573e183bdd46ae0efe28ef6
-
Filesize
5.9MB
MD5a7a1b18423b772eb47c639c51c47d0f9
SHA154be9e5831f272440370ae57e56c892de4900af3
SHA2564a0c3ff087ac3d87fd2bd944341f14620a0d168e83e9029b942c517d57849bd7
SHA512e822730bb77ec338aeede6666759d3e41aac04114378962a84f8b78b8a816785ac6407525612f776d0fe819fc1096fa9e74b3a7bee4ae11408196a9fdd960898
-
Filesize
5.9MB
MD5f84ae95ad385e80fa9445cd5603508a7
SHA1eab9b4757e7d966ea33251684a9fb34e9177b49c
SHA2560f89115fddadb0488502eba60bc07b2e32485f85dceed882d3cf7afc1fb4e5be
SHA512eb0d38e2d66c1bef282e5a8f48f9ca1600e02c9cbfbec0bb12798ef2ca811f9308f50ea4be3b2315ac783a57657e53b2ed12e43bf8c4a3f990e35030ab790fa0
-
Filesize
5.9MB
MD564457c9bdff9493850dc149305b59daa
SHA1a111259455203a93f2a57351c79278484a7b5ba7
SHA25683845ff5bc90ede06e11851e6e913c7e42b4d02805302f4ce24ba062931d9d9c
SHA512a7457dddcbc80e3ae2ae55e79124dbd40ffd3ce1b19670220b12ea1ff837da6b78a01480ea98c5c813c227570e473e8de1909785ac84a2d122c80755ae5893f1
-
Filesize
5.9MB
MD5ecacfd0b2631211dbb79d5a4c197b2fe
SHA102595163ce564ea5cad95b60128d8100aaac8eda
SHA256784ef28988050d0f4e12fcb9d567cc4d997ebed914723bcc168bd6a4cdc2e5b9
SHA512fcf22ae34450ae92c6e5d8c375d3b1d1d95db12501d61f48ac11431e5c8355b1c085f22fa7c0419d6df3d93e2509338aecc3da52fcd57253c55ac2de95ca7f4c
-
Filesize
5.9MB
MD57e4328da3f31621aaeb9be911c1d5df3
SHA198f5dc54b0f90ec7fa1147e0c564889e03d42d6b
SHA256eab1248ed0b07fffe1e670da286f39196eb868efd70a3786e885c6bb8cc18dd3
SHA5127ca5834f7ccd9cc8a51f4025ad39edd3522e029943710531f525b4b38b421d1a931aded47950a45d1bdd546d353f397d84977f2fbbdb9ec075888f7dd7d16bcc
-
Filesize
5.9MB
MD57628834cafa512ee791ec45c3f2395bd
SHA17c28b526919d7e36f8ac2a61a19ebefe78d01564
SHA256a271c41af4b70f1864098da1c9460e53df62dc4e63946b7e2420a396b844dc0d
SHA51270dafe5696fd70e34d187341bda34254d05d663cec32d2bded3e5d922ced4981f523b7b78bb32716e2c06509e7dc77d5688a27bf07c2791f67048b03b6dce6e4
-
Filesize
5.9MB
MD5d6581d94b72982c0b13c28222b2b89dd
SHA1c32122a3f32c1c36f5849b96008254b143c7765e
SHA256fc636d849ddf364ff5d47a9a29385d5428c7889a62dea7f665abc96c8a381b8d
SHA512cf7c31387400c4d48c701a41b2d67243f2fffc23da3f61c3349ba1866c6e2e3041019399f028c492c459e47a5cf1c0a068d38a7f02a4b7123503ffc572115340
-
Filesize
5.9MB
MD570cbb0c6c4975c9b43f66e3393733346
SHA14344df82b23e559202aed43e4ebf56d053754426
SHA2567357c658a4e1f14fe580763689ec724210d8b0b3d63affecd73b784cd16f1258
SHA512d8cb8482bca5a0885182d47b330c2abf5746813cda85105088dca7267e5f82bd0578dad92ca2b45fbea30683736dfa0d28ce6d4734ad229e83d29074cdecf800
-
Filesize
5.9MB
MD50cbe1a5b9da81f452f1b03dc64a67307
SHA1aedbb62c194098785af618258849dfea6579a11e
SHA256d656ba9445deb9a0b67c7d98777509ba358946577a829cccb5ff83167666ef15
SHA51294815ff9d12cbe4d55f6a0fa034789bfd1959c8a0c87c8f827504e52905314b74ede850ac6d13775dbf3a7588cef25ebaaa5bde975322502d86baaed1c76cb1b
-
Filesize
5.9MB
MD55f06138f28224a11fdc931a9335f0bf1
SHA1e3a46d4c78a158ad269ba655c68d8dc63ca1cc45
SHA2562c4d353fdc4a5e60475c76a2e7bf6bde82b43ae0277b8dba6325ef813619843f
SHA51269d46d1ce299b0f21d0e64e80938ae767a753f7ec4d6fd13a0a2c52a2e942a49ddb22bb889314992d0a963d54285618ccd2dda1a34eaa63ed470c45838134ddb
-
Filesize
5.9MB
MD59dc0824d7ee64a265ddb4a2add79b322
SHA1ea2e8034f0ccd92e54172e1b5fa9bbdb3be24949
SHA25667513032cc122a3531dbb66e999f19ea4627c139ac60ed94358ae0795aaa4a6c
SHA512583386160611f71f393127132063927ea5384af0a31b6b03db32c32806f5850a6a4ee528cea6b6bd8247ff3df5507d971935cdbb33258ff76b181e52ca77c696
-
Filesize
5.9MB
MD549f00779b1c8f317caaba805addd62de
SHA141a25dd6aed8f16c61d775487c5313a2c3654a96
SHA256842e81647fdd94f77df88538de88b4ae264945753f729f0d1775de8a0a543390
SHA512f72baa7e689e87bd137fb96bb38bb6ec4a315249c71ac159e925a94e76dbfbd340f67bb6106231f02f7639987e4f2972bc2f4254f3ce5d51c5b47a735ee71884
-
Filesize
5.9MB
MD5a8502d63a6a00624295e18d330ed946e
SHA1c121f4453ab88e6016028bd3a553abb552674c64
SHA256c9a3019c8959fbaaef6210ca209fc504c8ca5e37eb311e5da048676d3b2f4285
SHA5127ce06f30d9155f6a368f0632ac20adb21004a5ea494f0c02ccced4ec8a09d39ed6bf1e857db82382ab44bfcc8d065b280a54a75ec3ee897aab88493a2433c4a7
-
Filesize
5.9MB
MD5c7ec2480f3affc46083d1099a463b577
SHA1d341a70d3076979e3ab90ae6e8f98e9b41ae64e3
SHA25682eb56b7c2d12b3772ca9cfd284104ba1d58d962ee918a9c12738a0407525ecc
SHA5128b20e18e8ae9091ced3c6bb6fe1869db0e495ee9a68169492a6256bbf12f3eb2718848b4efe30a0938cd952376a72d17dbf7c430080bfff6a2514b4c5357cd6a
-
Filesize
5.9MB
MD51c2d5d709fea36992b3af8e8b702e64d
SHA17ea4068959e3749a29630320681bf1f3039f6027
SHA256a34f03738dcd7ddda1afffd54875855e17deff1fe5d75dad03c0d0c89f1c0025
SHA5122e2eca86c4f7b557d6192b65f07e92917d9b9f76e8bee379ba8ce67d619e00064f657146fbd38d1abeece205d728aa8e5a81cd9ad6b6bc2b949c591c69942854
-
Filesize
5.9MB
MD5b662d581b9f5cad3beb3be446e90837e
SHA15b34629322c3ffd780e0c595a474efb2a690e60f
SHA256992432b05aaa55ea1d923063f57f01e940f7f1243e94e017f4b0ed88040e7462
SHA512ae6d207814b75f750dc8ff5562aac1728ee9cf4cbb2d4a347a6f31ee7d0b6d154c435590c847c950cbbb5aeb4200eadc866fddadfaeda87eb3867c140e824dac
-
Filesize
5.9MB
MD58f347b7d21faff40a5780d28f27df63d
SHA1f9e605912d3edb0eb9cdd40e1d82877c1d7060f3
SHA25662aae3cca109eb36af11b7e691361a5af665340615f9dd57c984812c3a8696e8
SHA512d098d0831d0cc4ba7f2fe32820befaf00106c94b4c3b679a964f29ca2eacee000a4f1b14f2778b9c7f2ff8b84bf19f74997179d14236d483ff117f63c1d1ec18
-
Filesize
5.9MB
MD5f5ce96b9fbf2ab8cac0aa3c714093798
SHA1dce3c392c1d4cefd031f254a5095aa120a940d38
SHA2568d0571dac6994c3ea72f2faf27f9ac77130c35a12bf2ae9d40134f0f64c39861
SHA5129886f39a9212424379d686b7358d4af1fbf395643eedb1c09113801be930e0ca2acf1dacd1730d2d61ce91a26bb29cadf3aa0d2567380687bd3fb151d3880f3a
-
Filesize
5.9MB
MD551494545a54a5d298cfd9896e398b845
SHA16d9baee4fcec565a7c5d413c98f0a9afb41d314d
SHA2568d32c4fd6623c8aef6df027276637946e4f7d74b41e07031d0feebfd06993188
SHA5123b7b1de59bdd088f5d8c8da5c14691118371197ef0830241ae6fdc0ca31e2cfa706c7fceb3853b419e96b62ab18d8b9bd7f532a28ebd5cb320720c9c7dd51b01
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB