Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 21:03
General
-
Target
2024-05-22_c5e3f5b300bd3e7060f6daf6e0b894d0_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
c5e3f5b300bd3e7060f6daf6e0b894d0
-
SHA1
24dace7fa388e62520c4b952aa0d7b7ddea1f32a
-
SHA256
f5b891ae8f3281790e3b0090a1194368806795e7040877bc527c75f4e78bb59f
-
SHA512
316cf2914ebbb5965467c7b04dd6b4c269b390c287175b325166726bf87b4449b7a2dc03de5de23e413617aa3f55a0f909b220226dd11ea24583e65b24ffc03e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_c5e3f5b300bd3e7060f6daf6e0b894d0_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_c5e3f5b300bd3e7060f6daf6e0b894d0_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rlrcCNs.exeC:\Windows\System\rlrcCNs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npiwHQJ.exeC:\Windows\System\npiwHQJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwVHFPX.exeC:\Windows\System\AwVHFPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oClRLGC.exeC:\Windows\System\oClRLGC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MNbcIJN.exeC:\Windows\System\MNbcIJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJKWIkV.exeC:\Windows\System\yJKWIkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmdCzJE.exeC:\Windows\System\tmdCzJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJhAHfZ.exeC:\Windows\System\tJhAHfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hahnrgn.exeC:\Windows\System\hahnrgn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxwneza.exeC:\Windows\System\dxwneza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kEUivoc.exeC:\Windows\System\kEUivoc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcYLhtl.exeC:\Windows\System\VcYLhtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMWjaLQ.exeC:\Windows\System\uMWjaLQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKTzwDD.exeC:\Windows\System\iKTzwDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVGPoxi.exeC:\Windows\System\hVGPoxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CWgBBkV.exeC:\Windows\System\CWgBBkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIEOtbi.exeC:\Windows\System\JIEOtbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bHkFBHY.exeC:\Windows\System\bHkFBHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vKxvEGR.exeC:\Windows\System\vKxvEGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oOLyCQi.exeC:\Windows\System\oOLyCQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdqWwXi.exeC:\Windows\System\RdqWwXi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a574db9a770c91ce109a6bc99ee8c1f1
SHA105f16baecea4b66d5d5df8683d84d4e06242d63f
SHA2560068be446b3d8cd4ac34a064876de82234e71375b8934d0ac144e184ae19cd89
SHA5126787a9a1d79d5c573726cb4d7419a487571d8ad6976188c7535ee0de57b6c5e3490984992647c367882105ff33df224e3d8c435b60d4083ff722a81c22ba5c29
-
Filesize
5.2MB
MD5ca47a24747cf73bd8c9ee4bb01f25fdd
SHA1ebe7d5ec45ba7dccce48521b1926a93127295909
SHA2564602958744bfa7070701f7f56fe19cb1446c908648b2f075d194628093a2a42f
SHA512fbb1badde4cbd1de822451520b47f470f6302c3cbb471ed1650bb2fbda928f3f3176be2a6f419350592a05bb9d61cc576471b9db6450a46ed55b56e7e5290230
-
Filesize
5.2MB
MD5971ff64b0fcdd29d5b37a4198201d98c
SHA17087499da5e17ced66c32ea9b7a228f82649f3a5
SHA2565d88c6c9a14ee11cf101287f1994f6771348394792164b9fc5e37024bd1c46e4
SHA51297e3454750bc877665e737673aa85399c0d6416b59ec70e0b93b9b91e77e42254403707b8c3de781e8cbcc8981927f85614c6a93d4e7a2a3da9dd3053f7ee4e1
-
Filesize
5.2MB
MD5ef9b862b3b3b57d7cc1d2a0b5c4e31aa
SHA141f48e9eacc018d07c7607641cc3bbce559109bd
SHA256a29c9e897f6aebde17a0c3aa734fef907d2b6b7152512677547f720fd5b02b90
SHA5123688a4c5523832b92f1323eac742176d62de21086ed8b24a56cdd405195937820de52173c3d45b3fb2d762137a73d4f2bd47f971f4626da1e3452b46197f2212
-
Filesize
5.2MB
MD5551feb8a00c4136cb453095ebe4fd9f3
SHA18114dd338dd164cc79f8848a33e8d7ee55d9b7f0
SHA2568ec7e64994e7fd1dab08ae07a1c9bb1afcae2d5d599448f406df3413acf22357
SHA51202fb3233aa9e80ed85ba693306b4681a2be9d7a79c10770b399fc1b041561d41ea70c9424302ff06c9acaaadf3426c40a6624f4c09b798e00e156c79f7dfaf24
-
Filesize
5.2MB
MD5f52641e2abf962a63038fbc6196d7004
SHA16deb0b6ab7353bba11a8e01e9d8880dc70db4584
SHA256ad25f8fe14b40bceb8da76c65e82ad6f387fc183b50a1dc18e25c52ab31d6716
SHA5123799f9d95d017d751697ceb9890e7147792a66168d8cd7f51ebdc500c6927c35e1005c2c2c4aa48d6c36d8794dd1568fa1e0fe6ec862264b80fec6ffbff9c0b3
-
Filesize
5.2MB
MD5a276916279ead9e659f7d387943440ac
SHA16a0e70b354f028d3ac7994e5dbd52efc40bdeaaf
SHA256824ca288c0bf57dce875b1b3392a7bd91c26607bdbe61925fdf19e34ea74c18f
SHA51273686f594e8cf41e88a528641fe40680ba3512d22c743fbc457abf5a9a09d7f62609a59008142830e007adb4a0ef95058a50038c679a1e4bed69092dec86f15e
-
Filesize
5.2MB
MD52fa3c0db1449c1f6af2a19d6e3fd44e1
SHA1ab29eb1555d3f05df9daa7763914ef8966f8d05e
SHA2567320f55a223301ac17de3a747452ee18463c9205a0d8c17666caf6c4101df1ba
SHA512af8cab6303685aef45f52c29aea18743bbb9476628d69f3acda272ccebd9291d4d9daf903fd4a37951d79177306e6163f9947870cd2550554d17f6dac2908c8d
-
Filesize
5.2MB
MD5d1cd782d694a8d035f6df2cc6f83e10f
SHA115e1e2decf18769214514ece837d740cd9ea36a9
SHA256d9eb2f38839dd6daf6bb514d640bf4b915f99ff7f57dbfff39f0fe7f41da3659
SHA51274d31140dd103cc3ed30a06122fb2191059459d0c46c7a3fe905a159fae12b6e6bf5dfcac12f185c607b8fdd4287b10452b4705aca9567f3e8293ece0668c22c
-
Filesize
5.2MB
MD5d311ca33e1888aa854e594b22ed8a3be
SHA16b960aed0c17c2ba469029b9a1e464f5cba5b6f7
SHA256fec68641ee15f35a0f2e83293f35149fb9a0dbb1b7fdbfc00b3438557fb54033
SHA5127a3deb886bf7bc8432cb221eace016577600e2769cd84c236f3d3260b86a83aff2236f8117feaae6c9efff9c093528f49c1ce3988c38a68764d579e71bacd60c
-
Filesize
5.2MB
MD5c08370082975b5519f98fbbe6831e055
SHA1351342be9024a3bc66961b5c1b789245d44ae976
SHA2568f6955c96b5d6e0037a6784786c37e63d112349a1a486601d6890a45e7de3692
SHA5122d0581ce2294f82e87549deaf1faca66804f79933902778d43a6e9038b943e309af1d37050562dece1f45296239a430f4c844956b36cbb384f018ff27f547db1
-
Filesize
5.2MB
MD5e30c10f817d419a9e57a4ff0ccc142a8
SHA1c163733e3200202d7935c70b35775a80b1eb126b
SHA256b61737de690ffd57657fae2716cc552ccf0e99e5856a1d30ea2e7578455c52ad
SHA512d36034ca8f6804f64c9b80466d49046ba94e16d25038732a239d37dc1b8ad093247b1df880e93846f51cc87b98bcd3c82d50c4f77fb667c4330313cbf02cf753
-
Filesize
5.2MB
MD5c66fa88bcff11fafaf128d479e096c52
SHA10e07486d4fa0b391e43b5759ce685e2c08aeba74
SHA2562949c59f535cf9e527b55ece1a99f1b3bbb40d9c49ae3e4afaaffa85dea54cb5
SHA5128bc101642ff21f877f69932eb1e75850f8398e5f66d45da977df76823ef568c5cc073bf1d47777a22962f8ca421e25b88fd5101a667a8927f897a39be1779426
-
Filesize
5.2MB
MD523ad2b4936a3397e834aec6b6764ba6b
SHA1c72f6db259a50c637fcc865e2252c88e590738c0
SHA25653071b73eac629e8d87b5b2156178b34ab084a0e8e571f214e2c23005a3ec084
SHA512ee1ab822c8abaabfa779e65d87adeba8e5d16bfb56d037bef30ac923143631881a65a42c27c5c9a7309cdf593102a56c6e1ca110a45fc19cc025269fc1cfaa3b
-
Filesize
5.2MB
MD55e1718309f5911c1ac88e32141d2915c
SHA182720551fd43be9d9582b913ae482ed7d4ae9817
SHA25687e53b0a5b583b022faefe04de86247be4b1f6a4850a34250632d985d724da66
SHA512241c203632d63957d94a18d608a51918e0f850593d7ab8afb44865c6f183485e21d877e74a86debe91e02d259639ef2faa232f6e995b3b47fb9c55c8a8728d87
-
Filesize
5.2MB
MD5c68a50e0a897cc2c63c63a9297f49583
SHA1b7664e57a3cd3bc58950b9a56140e722ba776210
SHA25610fe6c2a25661bf2a579ae256ae3cd70133c4af63059d77a4b1cfb249ab44eb5
SHA512ee0c1b805bef065482bed07613be709d6d042032cfd60dbbee5d3fe63985a842010a2c912fabc10533e2b800d05b04e7f77dfccc4b06502cccc2700441340ab5
-
Filesize
5.2MB
MD5094b8cd4d8c52799029ec4873411b901
SHA113a20faf0fdebe61b9fd56ba3960c1f1c3f9ece3
SHA2564aa9d8b3dc761e805657a47befbb30f65524d84f66ba92ef51b76c077aaa49ed
SHA51224066795fc07b23f9b9f4048affc3f573c62c4fa77b2f84078341445e213e17f58d7d4db0b105246e622872820c769d41bab5448fc4c66460306597caa1dad65
-
Filesize
5.2MB
MD57fd30628914668e17f269f1d1dbdac19
SHA13476aacec4b3dc721fb1f4f894963149d0f91e85
SHA256941618d5537d132caac0d4607cef118fd39eb17789f6e8ab9ef3ed1c0f9a7436
SHA512374b6012839bb9dc88c6635242b0b63173265295f52fbaca5782f8bad4aa08b6a57fdae3d63e1590a4583618673ff858e71a42b37fee5d027ffbe7f7a4d2daa1
-
Filesize
5.2MB
MD53d867a878a6d7f6a3e7531858ae2fbba
SHA1831689fa7971dd0c6f8ea3c2b9bd7277204f7a6f
SHA256668edf4dd18064a0a0e531ed6ecb05a687a1a66f5b9a6b881462521612e5853c
SHA512db00799cf0d3f4f6751dc21d959ae68480f9b87f5a1c7475f733cedcfe71a8551f99e5a294ea7426e9645daf41cb635f4a79e7b6df9d9541eba84e230ad7a848
-
Filesize
5.2MB
MD53f45937c2b99db5f7e11238bfc09df13
SHA189150d0c683cfc6350377de45fb1593e10c99bbc
SHA2563f88f87d486b4fb229d30d93ca24db9d52e422f31e615b582dca788fb60556d1
SHA51231de88b0f3569d358ad4e4ade340b2619ea8ebd533fe9710964f9f4f028a0cbc4887bef46290a974ac351d609d3d06123d99de48c5914ff313a8c069f2712749
-
Filesize
5.2MB
MD5cd44357152911c33dc86683e2c9407fd
SHA1be704c030904eb5ace88d375a99b5febc1a8b1fd
SHA256eb77c138b90fb7b52f6381d07fbc3204a077c1582f02e34cbc54253dd4bcdf83
SHA512345cd9c96f80ebf72b3603ddc38a2dbcf04421d2c9cedd13338c489be716a2b5c1dfb158d1124d0d0cd1616935cdd938fecc555288dc7020566a044a7bfb2c10
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB