Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22/05/2024, 07:05
General
-
Target
2024-05-22_d529a922da360715e2a3480e1dd5ee1f_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
d529a922da360715e2a3480e1dd5ee1f
-
SHA1
95bc2e5bbb29af2ca79e09842fa4172573b4f7dc
-
SHA256
2355ab65e1a76372836c79b496d853b0917d72b3c0de88f398b8169df1bbaa21
-
SHA512
0daeeccc94bd83169186a025b8c469329d6170d7ab0c585f203ae809d3e65937305111182c2735c269bd51e35bcea88eec3d6d29c7fec6fabfe41f8c174dec91
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_d529a922da360715e2a3480e1dd5ee1f_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_d529a922da360715e2a3480e1dd5ee1f_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZylVDqG.exeC:\Windows\System\ZylVDqG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHepDsW.exeC:\Windows\System\XHepDsW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnvnKaB.exeC:\Windows\System\xnvnKaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sdbSGkX.exeC:\Windows\System\sdbSGkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QiQXWMj.exeC:\Windows\System\QiQXWMj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgJgIsW.exeC:\Windows\System\AgJgIsW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEkEGVK.exeC:\Windows\System\EEkEGVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAxWBIS.exeC:\Windows\System\RAxWBIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycBiVXg.exeC:\Windows\System\ycBiVXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sybvvbc.exeC:\Windows\System\sybvvbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WSanPtj.exeC:\Windows\System\WSanPtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjqplSd.exeC:\Windows\System\ZjqplSd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvqJpzI.exeC:\Windows\System\lvqJpzI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQzSBdj.exeC:\Windows\System\xQzSBdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bCDPgqy.exeC:\Windows\System\bCDPgqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\faENaYR.exeC:\Windows\System\faENaYR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ntxjhhr.exeC:\Windows\System\Ntxjhhr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rsdBjUm.exeC:\Windows\System\rsdBjUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMWXkMr.exeC:\Windows\System\MMWXkMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtndLWN.exeC:\Windows\System\CtndLWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swLrifM.exeC:\Windows\System\swLrifM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5050e86afb30df582b938919f839b9221
SHA167e87162524a26f61c8107015e9677c051d1f35e
SHA2560dc34b112969086b77a78144480dba7931750841c205b0faadae8596eb81b339
SHA5122a6cd74347679f9c30b0aa348710c1cdbc9a4a402c620814532beee2b4d20aed022898b29c5c5cd8360bfee1170d1375d6770350a9fef5df6e162421cd6bbb2b
-
Filesize
5.2MB
MD554d6981be0bca5396ef5cbd86a0096fd
SHA13e1e30fae4e168930176fcc8eeb6d0da8363379b
SHA256c6ed993f43f4570077e4f880bd280a3232a5c1baf896326aeaece4eaed6f32a8
SHA51267bda3c54e2ee997f673b7df013a4ae46ab58a0d5f893e1dd641f3a0c1064fcb84fb5ea6189273f23a4386f839cadd5bfb36d6fab01d942cdb1a78672d24b5d8
-
Filesize
5.2MB
MD50018a543f69f4505ce17d10cddfa9911
SHA143dc98155b86814fa437c4ae7e0edf329b8d545b
SHA2566d93159e9b73c61c68242adf41ef80caede95af00c10f45c5e29cb66da36c384
SHA512a248b750f08978d67978582f8d54159b94370e5ee913d5652a028dc81e533fd26ce00f5a9427307fe58851dc5d2b796e57bcfdb49f5e1ffe3013424656fc87a5
-
Filesize
5.2MB
MD5c56cb7aa90dbe23258a20fb9644b64c8
SHA11b56fb988eef7610c14cc8f86a8ce478b81dbe3f
SHA256ac8996585cc2e5874de114e2df45587f23cf2ea9a8eb09f498a1342c87f2f912
SHA512f2fbc75a72a9e4b591300458415161cdbeee8e688b7e8e50a6cd01b6603022003f40c1f4942c108ad0e9ae603a9fe7b7d6a40c12dad2127d06d9caeeaa3de237
-
Filesize
5.2MB
MD56dc4c0d014a2b9a64d1c3fa26d795394
SHA1e4f32b397c5b2f65ce05c94289c441ff6ae96ffa
SHA256bf12555be5e27aac10c3292fef768b7f4f87bf33c320b5645c41f1319b8c38eb
SHA512987d176ceb1e0e9c02e529d58945aaca71c96006a49d3261bd95b6c1b8195ac2274201f8f012e4dcad6ec8973c485b8223092b4d19a7e0f842c3f1d4193b109c
-
Filesize
5.2MB
MD55e1e7bfe2d2bd9b479cb5f8e71c3947c
SHA1aaaaf67fe5a63bf68effa3ad7dec0b84993edb20
SHA25638166704ebe6d5636823323d33d6bd7781d1bf0dc87cabc339cb675ec400d90e
SHA51205e38ea6c99c64175f804e18077f5d8514d1b066f2d8666c3bf978f2a7f80f5339d934ae01580c857021d596c9e08403600800f92c8c90ecff382eee8078143c
-
Filesize
5.2MB
MD571dee8bc156895976ac28639088865d5
SHA1807b396f228e3fdd5e4458691d321f20f40ea945
SHA2563672868b169432c12b869d4b274cd5ff90d26495c9d95e492ebbc0c66066ec49
SHA51241593e5f6c0fd6456e23123bb00720009c4e9dce602399e0be557d46a7b7b340791b2df684ac4c27cd211d441bddc36cc326ec65c6f870aa6cc0e88e61348e77
-
Filesize
5.2MB
MD535630a6ddd21e0397046186509f47891
SHA189abc29a50949e58a9d19a8296d5c113b340001a
SHA2567aa079f5afc5b075eb7902015025c12d61c28e390c98f8b0ddb514ea382c84dd
SHA512b499277d8facfa64815462f84e6e64fe2e3d9b36e8b8de8bbc6fc57a88aa4c1e369ecd0398486e78343b73e46cfa9e64e08154a20b12644ab29405afbb73890e
-
Filesize
5.2MB
MD5889c6f81f3bd17b5262a4b2bf789e6b4
SHA17abc566b075f6d28197da020d4b245d2ae569e14
SHA256d4775ba3db5f2d40221089a57261e8ca31587e3d5a4e3fbc76fef5d038ff9889
SHA512ed9544b340643bb5ee2c93034c08d232e2cb7ec976e3ef857d65c9742d0e5c6db77b1245e543864a68430f4dc952c079aaa9b9fc57f4b8576ed7e792b182949b
-
Filesize
5.2MB
MD5686fd0948d65dab498e8f263799249c1
SHA15e4c7ce4042225677267157f1fd1fba98c520b99
SHA2566898931c304b63d74e21e3e21c160aeced94df35d9ba37ada8cc4ff3b288d45c
SHA512aa9fc4c0346f915685a92991e0fef436801453f7006e791b78b3ecdd5c5f9d7b45b8363510f7892a1e97db9d640fee7e8936a810be740547c9b3df91e6f20b42
-
Filesize
5.2MB
MD5202bfe77e98488ffceda8f8dc6c4b0ea
SHA1529c0b57f78357c732151452f13e805e0fb69532
SHA256dae81d7893af094d64926ea8403fba9bb32b3dc13c95ed6cf11d57752560403c
SHA5125f679d00e3188cb49bb3a3a488da1cb164a3c00cd247479d833d5a2196c80c908082a5b4d71f21df421e8f6ec5f2954557e9fa325069d23831181de772cc538d
-
Filesize
5.2MB
MD54a8816fb4e815d10fd5957362e44a6f3
SHA10ad88881d7762bfc3ecd2444042ddaa138c27d10
SHA2569ebe2fbac7b542ca09b6635261f409ecba66be0de1708e5a3e2455853da59870
SHA512bfa073064c98e7caf61bb5a59e3e2061a4f04d5121df4c01c9cf6f205075a276f31aa8cffdb2d92396ac9b4e74705e8441164b21ee7b2e34fc1f7fbc65017a06
-
Filesize
5.2MB
MD56b83ba50b6416a241fc7ec17eb4bc200
SHA1ae95a72c15ca8545d61bca2b699e82d4f8cafe20
SHA25688969b2d6330d7fa0ce7b52208b4a2bc8fc9e8ae952e0aa83937ffb5f956e9d7
SHA512f5e3120aca2b5c0846dd9eecd700c9e55aed8cfa2eb79c1a1de2683af60ae6475b6287e4254cc8d4fa754601ccd527d34afc1ab930c7e75ac6deabff509683f2
-
Filesize
5.2MB
MD5463f7880e2947a4752b4540fb90dedbf
SHA124baff1060d6d425e25b56159a862b71df684a01
SHA25604661d42ae1c0eabc013251a439a5cb55082461e2bdbd1f3b6865886624590a9
SHA512f2a68b6c7e7574a94f1c463c502da3558bb6b080e66236bb708588424907c012fc12b0affa0d8edca84e226708cf5e5affdd876262205c75b9f384c4b4db404b
-
Filesize
5.2MB
MD5d070934514e3d29612e8f5c486395132
SHA159481e7155309f520dea2df1b2ec618239255fb8
SHA256510fccf55274469a80c46b047f3b4631a37dcf851c72fa5d757fbd43fb5c2ee3
SHA51253464db99f7402b5c49d5a2cdb7877943a923baba20014718c8c2bf765825ad9542838a1a31db61781eac22b0e0b390b7f34d072503dba8ae5536cbdae488b5c
-
Filesize
5.2MB
MD5a95df02a662403a4afb455b8fc0059e1
SHA10ca4f7614a6b63ff9cfb75dce039dee1871646de
SHA256f0a144a9b8dbea83740a17dbbce7340d362d5a54312ea89d0870ab03a9485a76
SHA512e23c13066be52c5a4c128a2c1c4f4c2f257a2267af9de829286ab4a1937aeaf5082f551804daf3c264630c81c293d198044ed36ef6822b8afb1a908943db1f30
-
Filesize
5.2MB
MD51749a40ec63e5ed6eba04684855757c4
SHA167d9ebb014ebe3e4b270ad1cdb5170b6529467ee
SHA256ed9f8356dbb749c89bbda06f81f31af210a783fba1be839d861c4005fb49ed68
SHA512e882949fab9decbf6b602e54ae9eb9459278edc68afbf81c07c074fcc44d91351836787cd8043737ee21bf37eb0420d0f64afc705c54d37c3658c7beee7f29b6
-
Filesize
5.2MB
MD50e32050f055977df023326400169ba8d
SHA176474974602c0cb5dade917db96507519bee95fe
SHA256358267bc89c0758ae64e6b0f5867aa9dd812ba15e82640120b0c60fc58522d4f
SHA512687d948ba9aeb4dff250326e80e6b0f744944c3fdd96ed99e73e59aae7d5dadb7a42390aee84458d48d410e7a6199e75b84d6eaefe3c1f920d0452c5f1f00f18
-
Filesize
5.2MB
MD54a8aca5ce430ec5132636be3aad06e3c
SHA11f448e42cf1179eb2fe8848d47a6747d33dd79d0
SHA256a9a29f3ab4f0231fc6b9848400d1ddb7977b57a9d47464b30550d10e1d809b36
SHA512e883bd1b728f72162a8017a84dc06b3479324a40ddddbb67f8baf4092df55c2971174a168e4312b99fad54c984641fb2a829acfd53359dbf440fe2d7a303faec
-
Filesize
5.2MB
MD579603db996ce972124b9922a2d07ff69
SHA1440e6abadef138a782fb184b74dd9aa0e319a270
SHA256fae7f09743ab79a776c52abf80ae43d3ab73a016374254586e4ed78ca177e7ef
SHA51259b8cdeb1122086ab04ac9e60cabe8a3a4b3c35176e287b561379d90cc2bc9516abcbab7701f1725a138908b7ed0ff4892047ca47ae41f10c588b368efabf41f
-
Filesize
5.2MB
MD51c8cdfe61e62720a5d7686e7fafa79ff
SHA112d42b4fa5ca9cb808b2799c9768219da8975862
SHA256abc1804cd8068de1816f3c5183ca50edceca68d78a4dbc2166af1eaf2a3ff1b0
SHA512e2f3b2229cd5afdc8485a207ca2acfdfd48ab8b9661680f300c38be3439fa472bc65d25c1463164f3b3bc91b796d977eed3e07fdac4ab3b697cadeebb6156cb9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB