Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
22-05-2024 21:02
General
-
Target
2024-05-22_c0c8395c28372c46ac0deffdf24c6e8a_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
c0c8395c28372c46ac0deffdf24c6e8a
-
SHA1
a32ccab9bef5abe403b9705c1d1306652a445755
-
SHA256
4f02cb8dc893619c18387387bdaca2ea4b66119fb6b6fdc5d44dd3c77fefc3f2
-
SHA512
90bea8b71a9e19fd2077b08b0fcc72e34a190441ea44e104227c5be189a3f4c3985e7c22ee2cc1ee73d6118cf51132f37cd8e9850b4f3ce858e4ac9e48b8670a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 19 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 19 IoCs
-
UPX dump on OEP (original entry point) 60 IoCs
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_c0c8395c28372c46ac0deffdf24c6e8a_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_c0c8395c28372c46ac0deffdf24c6e8a_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QAqFsYM.exeC:\Windows\System\QAqFsYM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JcWWqvp.exeC:\Windows\System\JcWWqvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWqvjvb.exeC:\Windows\System\SWqvjvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzaSITS.exeC:\Windows\System\QzaSITS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFbRbix.exeC:\Windows\System\MFbRbix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnBzsjm.exeC:\Windows\System\fnBzsjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwkrCeH.exeC:\Windows\System\FwkrCeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rMvAQdT.exeC:\Windows\System\rMvAQdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ytzGJOh.exeC:\Windows\System\ytzGJOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uqgGauy.exeC:\Windows\System\uqgGauy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\roVrrgk.exeC:\Windows\System\roVrrgk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SilITiw.exeC:\Windows\System\SilITiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltzYfJp.exeC:\Windows\System\ltzYfJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpagOpC.exeC:\Windows\System\LpagOpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wdnNKsD.exeC:\Windows\System\wdnNKsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HtAPkUX.exeC:\Windows\System\HtAPkUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uVFPRKa.exeC:\Windows\System\uVFPRKa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ECAODjS.exeC:\Windows\System\ECAODjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPuqetT.exeC:\Windows\System\lPuqetT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFLxpZu.exeC:\Windows\System\bFLxpZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fsTwpdx.exeC:\Windows\System\fsTwpdx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56003dcdabdc2275bbdb72d904f6d526d
SHA1550ff0a398c00087b179d9952119e140b745912a
SHA2566c8282ca3a8136fa10e3ee9920a9f43efb666346fae6c3c5d737b666fbdc17e4
SHA5123445788e6f24f565f93e12e3ea8e8d5e87d8bfb644ebf0445251dd413945020e3539d4a0d7c7d8569171ab981dbcfe4fd48101fd65c14a1f0ff3cc73e9bccf18
-
Filesize
1.9MB
MD5f98b75da98a6e0e1239b5d256b751dcc
SHA100401eed244038638d8d6ad80774f798e0600da3
SHA256e314ae3cffcbc38782d20a9ab40327d9078f1e53bd7a9f960db02831b6fd44bd
SHA512d6ea0e401769aadbcc2c09e797633094f2ed75b91a32a698e7754312bc496a8aecbfea98f489c47776d8f91992c4116686b2fae9b57f139f7b202558cd9798dc
-
Filesize
5.2MB
MD518a4980b9653556073f1c51918d007a4
SHA1724a392e4ff2c636e2b8f7da826d4cc041a06e18
SHA2565c153e2223da04d75b1ab0d6fd60f410d01a534f252abfe304a9fb78cb8a0ffb
SHA51225e3098fceb2509a8fd00ce275b47a422738c2fbdcfdb9df07e22662c19eda985246165f0d737796681760b49d95ee7669f278630326d02a3099dbc6e8471e0e
-
Filesize
5.2MB
MD5e9c222c176dcec93e6f4bcafaecf8dec
SHA1408284547d48ffa17a35887f077b4f23bb0a0474
SHA2562d73009204b2c349b2b19e79f38460acaa4db1841a5cf949ece7b4e9234314f6
SHA51289aa8b430a71579ca84dc7e3a5838ebfe3075c9c3e8efcbf9b6c81ac6851a82e376c9ed8dd121d216a9632ef094a6c84a5f9db3f4d2e69c8d55a20b17f8e42c8
-
Filesize
5.2MB
MD5fa3e9e1f2e718c5f2d0796bac907e061
SHA17e7eca153b07e42ac53140169b19e463101c2403
SHA256f13df63f21babd73714af110480b6b86c050d4b9e1a336a45e8e9e547173431a
SHA5124a628f1fa2f988a0e52f07a2893205daf7a89637c427c231ca49d0b52d5a0b118504ad65e76a9539798f479a99058088b78ee72b24d5485544cfe8057eb84451
-
Filesize
5.2MB
MD5b0dd9e57eabba51649d470c2fe6aed06
SHA1997d34f9584ccba1008fd6e6ce0e76c5d8a405a8
SHA2567102b66ea5c8fc0ef8702081bd8bb769e89c143002595591d91f307cf7e30039
SHA512a52a4813d54627e8928021896d4744e4d86360c9e129a7c9311dbfc8ce05dfae20c16a54332cfa3cecb3b2408ea8cbd9ada644e88ade2ceea88985a11b9050b6
-
Filesize
5.2MB
MD538f74c41757c902a43733fe48fb77414
SHA17f834cecd277c4d30b55f693243923f789c4382f
SHA256db7065311327a51f733b3cdcfb4d371189f64f4573a20d4e23adcffcffb2332a
SHA512f8a3c5410150d745f59e6b85d5002d4c53cc5a55ba0cf7c3129ef59487b29f3824639b65e5dc59ed6da70849633854d503018a1f831eea07adc2a0ee9841bc6e
-
Filesize
5.2MB
MD5bd298aef44d11295edc79338b7927833
SHA1ecd3ba72987fac6522940283fb3b729507019bef
SHA256317682ee315e87576b02e774307b1b2ffe9f51e78f642e0ca06cf35b4398f987
SHA51247988d1852fd95806f1d30e9db31640a5f6534931c9da73e9e101483ea7779f3e0bf8aa52efba726e2368c9e64ab0a5a46fc7778243be37a3c9671f258f71b7c
-
Filesize
5.2MB
MD5be3db84189aba2b420ed0bc1e2827f7a
SHA1eeaec3534fa0587fc4a95d6334728015d2590b06
SHA256c903be7eae3623a36e7c92f670e10a7faef84bb1516521aa9b7fd43930a9a6a0
SHA512bcfa6ce225b719e216a67e48e7f9ff16cebf67b1882e8da1168ba775334139d03830f8150ade261f6addb2787d926edd01b0434315421e7d2fbfed8db082c7b4
-
Filesize
5.2MB
MD574e193188ac1465964e222a719c66810
SHA1d467d7116fb0cc9905d3da11172222b1df8403ed
SHA2567d5a8593302657f8be55450a25c92f54095d583ec9f5e6a5f54d097c83b0b14a
SHA5129f17945a977948a1cd3da734d7b680b05756382d6445040ec816f6eea1329797b108d1c96b4aaff0a39909206c1c7cd0a49b5f4099f2cd0718ef24974c8078a6
-
Filesize
5.2MB
MD5730aabbc4e95ef0b12950ff56d953c5c
SHA11f84278c09f207b1889b2a7da212f6b5afde3bbf
SHA256f18858b35b899e630669f94ce7f78243f7f4b04ed84a46bab35a2391d513eecb
SHA512f3f26314438fd55a7a09e2406b6305e49b565a7aefdc6aa4b6de5c58f90534132c2e2f184c5448b0d1ccf95b08adfb6a3f5159f841fb4b5977169c0a8a6b9a67
-
Filesize
5.2MB
MD5a039c64cd8aafca6f281cb86a3694588
SHA1dcbb0a9307d0124c910b5ce81448b0f32944526b
SHA256abfabadec5a242036c6dfcff4013c09bc285ce20af1c4cf9554f5f6a1a76fe47
SHA5122fece4cdd30291029d1f894274e5915c3f3515c3badeb6a8d9b236359b7bacc5d1c2748366769d25ae1bb4d9c97e506c510ccbbf397a570765f69f8535d33e90
-
Filesize
5.2MB
MD54d00f4170c396317fa66ba55b2f3c8b3
SHA1f4d120116a243040cac4e9aea4f942564aef781e
SHA256bb59f04e70cc87a847615610ab7b482f4bf8ba37e7677268ca9735f349499ac8
SHA5127d9396e6ade9cc491bd80001755a5f289735b715716f9ec5ebbd7565ec1662fc58e82a50b8a81cba403a23147ab6606be034320443ca6198e26d1094fbd36722
-
Filesize
2.8MB
MD535d4b9b40e9b95b4a75dec06c4c6f979
SHA10b088ae4df4f56a63f25ba22b7e936e89c483dcb
SHA256a2e35e125d8ab4763501772c6c07ab280e15f436019dc190dfa4cb55de62bc7e
SHA51256c93fd59bffe6df5a120e950c179eec9dfb3eaf7c3f2e9804dbd4886aee0b0f3a2ad0227feedbd311243dfffa198f082d84fd5e6761249fd05b31e51ba2784b
-
Filesize
2.7MB
MD5e079a532debf2aa09ed43399f7482a78
SHA1d64d769e3852c50693e4939ff3c40188d985ada3
SHA256f0e2e71cee385e456cf0a137190ff1c1a4b29ed7cc4b5c514e44a5a394624d11
SHA5128aba5fe4a36db99c5343691e54a7723b5626c7b4bf43886827b3df3f80c7dcb9e6bc850e27458fb5b242f7a701bccc0b53ebc5b21d12d38ba652c2283e9e3d7e
-
Filesize
5.2MB
MD5032d5d1284ec32ea021bd1cc38773c1e
SHA197eb7bef7a76aae0cbdae7a7db9e81038fc16ecc
SHA256d3937cc1166dd1965c2d0c3d0bc5a0daa02b2e0d5a41d4088c462dd1b37b02f3
SHA512bbd8041a498bb1e533aa6d43b6ca4c79326170f534083f905aa656bbe81250197a864b46e8d572788d3a0743a8813d7c67d16dadc43fa8a46b13a9c3ba321c61
-
Filesize
5.2MB
MD595e876ba5453657c58ae930cda1c948a
SHA15618b26a5b1023516e9d6095c38ba1f57443e909
SHA2568ee84040c3f0f6a0f05104b2ca795ec63e8d2ab434a627ddead2eb64ac46863b
SHA512bbae5483ece1a613e56402afad2635406177bedb9f5fbab869fd500002b84084c07d3254c24d080c5b4e3c9daf9e6b2317ded7b344151fcd558a07e22144cc23
-
Filesize
1.6MB
MD54892d49c14a7e283153698e747ec87c9
SHA17822c69037298ccf4e2cd90381d1446721619c85
SHA2561bbf7ec7dfa34b0d40895a909b82a3a5ff0e7309cdbaab86e0d5c97264357e18
SHA512822125c120a17f4b7f203a570ed240a57e897b4dcce83658630a5c0833b272b84d104098adb903387f380218356f2efbba086a67aa762dbec174f6c315eb4502
-
Filesize
2.8MB
MD5130621c5cb233c2c5e34a452b595ac77
SHA119ce8b25f1eac341757a6b70c4fc354948156309
SHA2561dbb599485bccdff6e8b7b55b503da9749145343288cf7c7286b1d3d4096e5f8
SHA51206a39eaed256b9507e529307d1bf74f18da2cb2c422cd5767052c5f52205c17ccd87c28054a5f41af0aaac1def5649b2ee32298406129f519a9d26d4a28623f7
-
Filesize
5.2MB
MD53b17aaf539cc1857e829ec27f63eb9be
SHA107ddc023ea0ba5f75b3524b23e4bfa78751d32d7
SHA25616ca9cc5275d85391f3f87fb32645498a19480e527ae38794a765b281e2dea57
SHA512af7c69e1a5877d1d041a2c1b29b55ae27147a05604d12c2412d7ee0c1d4c90788677639532ad5459e100033fa18c9c6cbc053d0434664b531a4d5e5fad3d35a9
-
Filesize
1.8MB
MD5127fc12f6faae6241480d3135e552500
SHA1801e5edf3a087a26f7d10e6bccde102f07d029e4
SHA256825915c16780b599c32204b48d20a1fbcb4baf2eb57960853aa1679574121fb8
SHA512c859058e54b6a916c73c8cfc81b0347195ddc770d4112c2189cb2dc9a6aa8574b3ee3ca67deb659ca1901ed5c0c543ddc2ed6de390260167651487d0bed263fe
-
Filesize
5.2MB
MD5209f4076e0883f6b7179d990252c7ee8
SHA1b6b12768e48921d07df5a7c90d4666e3314ea26f
SHA256ec7b7167326b76a9698b1278831484d03ffbf6b57fe6a87f48426f47751b6423
SHA51236a02217cf0fa8956fe2ced8e9cb6fc2dfc08690443f77e9234912c66037254131dc2d77666e9c787e6a6b3fd6851cf69593d1ae8628c3e31871ffcc51ddadb4
-
Filesize
5.2MB
MD59e949e4b85d443d5840ff12696fadbfa
SHA113713499ef5a0a559cc9281f4c6b3160e6cdde62
SHA256213eb04e12ad7678eb81dff92b08f7f3e39a58cf91c808f514b21d9a54ded3c4
SHA5123e9be6e9e8d93ad25f9f60a02e272ced9f60e95ff56409a1514faf3186ca321fd21d33c7c1a951b4906441742d13ccf454f43469c6c5236f3b5801a83308697d
-
Filesize
5.2MB
MD5780793df4d4b3b6563392e4adb2fe04c
SHA1b6e81c51432f1af6289cb3878d0fd4ae364ce76f
SHA2566fa8b6abec7c53a67e1cd91338788a6abcc04b626745550dfa45e45581e789cf
SHA512a937c8019cf7669e218028e10d68ef03665f9a40fd3464b5f69e84f87cf69c2b2e3657218874539f24ba00b2a0a54d5980e50b16364e1b016897a6e6f444fec9
-
Filesize
5.2MB
MD52bb6093b9c782c12625fb574e89aba38
SHA166532731c7927a0eb3031cac8dbeff796786176d
SHA256e17222151a2bbfd23dc9c3f203d22e03aeab38a39bc0105886d5639fbebf12f9
SHA512cc6b4e23d21fa2d8ae731a24bebd85c5ac0d13d7d1610bcf3d893cdbe2f6e98be34b78c0c24fa861065a9327ac1122cd1023f34b20c8cf03e770443aee58f9be
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB