Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
22-05-2024 06:53
General
-
Target
2024-05-22_7342f8a69c027cfe701f7c3596f3ed5d_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
7342f8a69c027cfe701f7c3596f3ed5d
-
SHA1
1a9d205287c9a5fdc7a9ee3ddc95c637765757bb
-
SHA256
79a3517ae7eff769fdd51f596e480490087be738fd9c07afaacbacddd9bc458a
-
SHA512
818c88e9915d7c99fb56f2e059b520ffe4e4652c9d9cf6b046c5c1c007aa62d9627d2aea1afe312256fc6c5ae8fbc9f9723e8af4eabd9ff6814099b7966b9e68
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_7342f8a69c027cfe701f7c3596f3ed5d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_7342f8a69c027cfe701f7c3596f3ed5d_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bjzBwzb.exeC:\Windows\System\bjzBwzb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VEyhPHf.exeC:\Windows\System\VEyhPHf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cIZAijV.exeC:\Windows\System\cIZAijV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GqrgJId.exeC:\Windows\System\GqrgJId.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rkfAMfG.exeC:\Windows\System\rkfAMfG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\oPjwcGe.exeC:\Windows\System\oPjwcGe.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FtEstvF.exeC:\Windows\System\FtEstvF.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qNRSuwQ.exeC:\Windows\System\qNRSuwQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\acPNjRl.exeC:\Windows\System\acPNjRl.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\SJEkxOJ.exeC:\Windows\System\SJEkxOJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IuqwDgd.exeC:\Windows\System\IuqwDgd.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\WWVVKOt.exeC:\Windows\System\WWVVKOt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BEBiyTW.exeC:\Windows\System\BEBiyTW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xzbveKv.exeC:\Windows\System\xzbveKv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CSryEab.exeC:\Windows\System\CSryEab.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zrEnVeu.exeC:\Windows\System\zrEnVeu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qVgkONT.exeC:\Windows\System\qVgkONT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KbdIxsJ.exeC:\Windows\System\KbdIxsJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xudenBI.exeC:\Windows\System\xudenBI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\btQYtis.exeC:\Windows\System\btQYtis.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\fAUNJFS.exeC:\Windows\System\fAUNJFS.exe2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d80e8a75080d6def70a9a9e570f0f01b
SHA15efac56574f7d920338b1f2caabac15b89d2b877
SHA256b37c6b707abea3020a6e796533ec27a4bd0e356ecf7b25043b9338a54ad4e939
SHA512762842d29e19878ebf426fdc5aaa0e24deb81c830b12b316bba6df88410284bc5953acd5b4183e020d01272a0839fd6fd6ab100bb54b9bac24600b28176b16a2
-
Filesize
5.2MB
MD51274c4e87aa23e7a84c2a35f5a095576
SHA15aa519abf24db06aea25df5159c072bf732bf526
SHA2560bc3df19c0cdfa07b610f70f49611cfd642263752a559412dc1b834fdbe8b034
SHA5128daaf6297b828835ba173b6381e58cbe9a75b4bd18110ecb3c0e449518cc8ac230956f8ae91d7d97e254eff3da5dd173012c3a9cabd10bb42cf11ae640316602
-
Filesize
5.2MB
MD58c74e529868c5489ee01917ae67650d5
SHA1454b00649305feff4ad8616fd765d0c978d1e97e
SHA256d44fa06e45b1a84906247cc7d9780241644a1c467120593d506a3bd47657a81b
SHA512851ed6316cebf19d9fe1a57b980b3d9a34b6bb571bd5a32c9fe8318f8cd17e6d446da26e2d69dec203d4b56cbaf836f622f3c4eab980c7d2f271f2390bf3a0a1
-
Filesize
5.2MB
MD580b882fdd9d1a9d8c6021455bca56102
SHA16762ef472dd706e75a1a4dd1ea8e2ac6477baa0d
SHA25642b72fb4fb463a6ec3b3c6b5072b9b030eaaf2c7f0fea57ed15d5b0d450d8a3b
SHA512d7e0a4dae9a88c4ac5feb03daf66dd53b943a53cb8c06c2becd0c437f310108570c170945dfbd255449df3770351bb96bd63e20b77961b645210a1d3d2ab82b5
-
Filesize
5.2MB
MD5971523174b9a3cb7c050dfd260386ae0
SHA1dcdb45531becf98dd79a019bfcc5f6bb396dd6e2
SHA2562c1b8fc12696ec42f80a3b3e4449a69eee8a758bd1a4b220c67e783bacf6f40c
SHA5120eef5ab6fd6ae68833bc6ae2cbf5e4b6e692a22d1952ef8ea4d54122af7e1699f8d0c04f5e6dec8a6e747fcbf589708910af91cad3969b7b1254d79760435667
-
Filesize
5.2MB
MD59b9efb4702cfeef6e972dae61e8e349f
SHA188f2f53354323d824ef86a0fdf4dc9f36fb68ba0
SHA256634832e808d9a4638ee1aa6fd092c2f59c46ce89b5f00e07544ab25b6484453a
SHA512c439a27590099f0b1c75dc15036730924d060c417ace7b3067424c76a4434228630d40e1519aae85343ba1a4cb88e52e18c2d964fb515e130a051ab039a0e767
-
Filesize
5.2MB
MD560e10f0c5daf702292ead16eb70015d7
SHA176ab7086444e49189996fa8eba497e14015965a1
SHA2563ae0229e7d2a5cfd10fd15c66a03e3c0a43d86c737ed6659e4d48ac397663cb4
SHA51241722fe60e8388e0d03c9a2b2bb1247c5fef93fed3f8928af0db79cb4dabe2e5b1b847aa6749dd2f1819ef930f8f218f74377f587663bb2a6574334bfb52791a
-
Filesize
5.2MB
MD5b239111b636eb92898ac01f96d44b3e9
SHA17d6ae4f86b5c06b4b7438d30857e1a74630d4a67
SHA25624c26535dae7fb1dc9e913084882934fd712a1960c79032ef0cdf17ffb803aa6
SHA51209a2010a5bf571a2eb07bae3f00f3e7ebe1149f89df456266854ef8682c73985fe4c8d8708da0c1a78149711da46ca44fe336d34a4502c4a357b157f05094392
-
Filesize
5.2MB
MD5853cafa0d28c7d108368cfb5b2d4ea93
SHA1a3973968cd6621ce3717bb915a4cafbeff5ace29
SHA256b65861edda26f3dbd30c5dc7e5211b2f405cd0a494a84dfff6a557e714384c70
SHA512d77e833e156ffad7c847e19a7e7b3bef2149afe07e7d2d9991d1645b93e4264f628bc1912f1a48174f20c1ab4e5a1c718f44f55c4a6f2d6983f7c27d096c2f1b
-
Filesize
5.2MB
MD5cfa5e97f908bab7900ec3c4168616ad8
SHA1b6a39f5a2f2ec7300c408be4c29fe0b2c5a83b73
SHA256a546b8441a6eb38f7bd6f49de607e276f653c8240c89bd3fd4988127874dce49
SHA5121b61825a4c75510c2420036d842f96a268a0683c1284af0dc6e3ec9a5c25c7f9681f56f802080990b5fb12c7ee96848a98094ceb2fcd97c2102ebd7030918543
-
Filesize
5.2MB
MD5b8f1121654a8f1cf4e59b6073b77b4ff
SHA1723bd67f6bff7874c8f48dbc0646c8b02bc20c2a
SHA2561edfff08d5b61ea91b84194e0e7bf34cca50c04949dde9b214071998335e76b6
SHA5120f9a9418afcebae4b520b97a8e120dee18c98ceb2daa07becc0f8425b6e2c1bb491de338b08642909b5e0466f7a73c4d4132320c25d2f47e4d7f6c78e0c944de
-
Filesize
5.2MB
MD594fee1686de4f921c1d970a611a22294
SHA19040c5f82db22615b9dfacf1dbb2ddd83d5a2be4
SHA256e87c33264d991700b67543eae53a05c7a152d0fa5939b3eab1ccb387217b9f3c
SHA5120fffc54df43db0dad3a9ea44a7d7d1a3e2d93c82f996aedd836394b35b7f2835ae30477fbac56e15eac23c7fd6dc57a5c83878ba9b2e21d61165a6f8ec333ec3
-
Filesize
5.2MB
MD5c4b7bb14f16020feb2c9a461a6f912a1
SHA1ecbb36eff00ea0c965f4d4072268dd8c6286e514
SHA2566eac3cba17827211b192a5e52b098a532b71c555943217fd54e1ceeabbca6579
SHA51204ccb5b6df7ba7ba1ebb17abf45eb3903687f77a796e9bea0aaec76f8976c4e2b5a7a71bb70d63209f3a0f1de151a5c6bfa5597e1512a04182b2a0182fc2517c
-
Filesize
5.2MB
MD583d873af0589858b5e9780692e3cbd98
SHA15222558bccf302b243832f9322e730042b384f5a
SHA256670df4062ed52fbd113fa637a937050517b66ac402c57110a85fdff711f4f0c5
SHA512e7d6c0e8fd1f4e807fd6ef44ee913bfa405224f6caebae37b97d460e201919802516aae2d02f093b1d564eed5bd466dfbae528778a12f49e89fc43de2860d602
-
Filesize
5.2MB
MD559329f4098a1e11ed4f7716ab0577c2a
SHA12eb245ca053d4433b70ffdd0779ea56211d329fd
SHA2569b9340b0af0b6ad4c260e20cc9e681ed67209432c6c4232e054dabf51f616fdf
SHA512fdefdc0d28e0de2f7c9a14e2637eb98d6f522d219ec62f613aee17e96359f89f4090ddcf836162a694c94ff1dab0b3cad69a199a23a89ef6db7d43fe701d75f4
-
Filesize
5.2MB
MD5428bc40ba0190e8048a1d4b825da4db0
SHA1a6e0190696def4c0d04944e69240f1927fd8551e
SHA2564607581536fe06e6456d3c61208e7a46aace10cd1868784bf47bc0413c45877f
SHA512a2a022acdb9b94f61989916048b184d5c4df1d74c4a5d716a0f310efb864e70d926499a19bd4b6ff95560bac7849caa91e684b5bb32dcc48c1eb9560b1bd277c
-
Filesize
5.2MB
MD5486ab4b8af192c9f2383513c844b5d32
SHA184cc5cd926a8c864e3b7e96e4a9fcbdb5b484c7a
SHA256fc904f5d14afe5b52f94407b87c6b5c87acfdd632c58ddf1c125b937bf9378f2
SHA5124c469bf9bb3cef0751358b474119ebf635f9bad8c090ded70545d610bf7aa36c3e68a7c5dab6c35333f66045e57ed26df02bc682553e99d7b7a16639d8626d94
-
Filesize
5.2MB
MD5a8f88bff1ce599bd0cc0a71fad144cbc
SHA1e7c93cfd2faf29ca76bb08728565527881c6ce93
SHA256059f29e326372081363eb9b5cb26fde8e7d3aab79a3a62ce0551ddc01dff84a1
SHA5128f312b6c2d7be62d2414003691fd4d30d8ef252e0ce71bc6dba0962466171cbc61ef00d994d9224368bada9c2d1a3ddbb733632e08d53e2a1cc5f644736367fb
-
Filesize
5.2MB
MD5a6386734835b26f53cac861a45a43b83
SHA1c277afab0823dfeb2c427c76f5c9f9c119443548
SHA256b8bbd0baf248c37845151a8065bd2c61b67c522a5285ac2795fa71dae587aed3
SHA5129096dbac906f4a7231ac0c38ec430c1d61e53e1de3fc6a64f25bb6245a0d53e95f369bde8b6bfe41ffdb840bbb1f41662be3f1dae9c32f33c5f00d1f9835d9ae
-
Filesize
5.2MB
MD53e00c9fa17bdcdf02902c4554fccf22c
SHA179c688ae6bd8968250067951dc90d014dd25c64d
SHA25603b2a5d61087d1d1c087613267995352291d259c6f885da9e5210355f6e5f4ef
SHA5125b5d64649d6dcd3905d852f018bf30817362cb3076cce6f23b0bece44ad2b4026d028a143d2b991f51ad2f6ff2cfdbc4e3fae80fbaa8d8a4493c1c8e61b7bddc
-
Filesize
5.2MB
MD5d1b1796443ce877d208c87dcc348e7dd
SHA1eecccabc39b0cfac46fd503eb4e9c48e744b53ea
SHA256f9653264932cd24389e33514c20e32d75bfc88f1598b157dee988e236f4a1f19
SHA512c9ebd7e57a95b5129519bf1c41c3e83ba1ac43ca8004fa9ae63fecbfb71615d42c9b36180b5c030a490f0ec4359b61dd0bf1eff62a447dd405b167bd80896152
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB