Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 21:02
General
-
Target
2024-05-22_c0c8395c28372c46ac0deffdf24c6e8a_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
c0c8395c28372c46ac0deffdf24c6e8a
-
SHA1
a32ccab9bef5abe403b9705c1d1306652a445755
-
SHA256
4f02cb8dc893619c18387387bdaca2ea4b66119fb6b6fdc5d44dd3c77fefc3f2
-
SHA512
90bea8b71a9e19fd2077b08b0fcc72e34a190441ea44e104227c5be189a3f4c3985e7c22ee2cc1ee73d6118cf51132f37cd8e9850b4f3ce858e4ac9e48b8670a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 14 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 14 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_c0c8395c28372c46ac0deffdf24c6e8a_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_c0c8395c28372c46ac0deffdf24c6e8a_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TkKsLzE.exeC:\Windows\System\TkKsLzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLQesee.exeC:\Windows\System\eLQesee.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BORaANe.exeC:\Windows\System\BORaANe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzMlVvE.exeC:\Windows\System\rzMlVvE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgYMxIr.exeC:\Windows\System\cgYMxIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwgnORy.exeC:\Windows\System\hwgnORy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZhbmUR.exeC:\Windows\System\PZhbmUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUhvVfw.exeC:\Windows\System\SUhvVfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AerVpoj.exeC:\Windows\System\AerVpoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GZpPkyb.exeC:\Windows\System\GZpPkyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NABPmTf.exeC:\Windows\System\NABPmTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAgqzQe.exeC:\Windows\System\RAgqzQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sCYjzOj.exeC:\Windows\System\sCYjzOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCfKUUR.exeC:\Windows\System\nCfKUUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBQLGHn.exeC:\Windows\System\mBQLGHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQpbzDa.exeC:\Windows\System\QQpbzDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVLGvfG.exeC:\Windows\System\KVLGvfG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzXWTAY.exeC:\Windows\System\BzXWTAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ewuCVMk.exeC:\Windows\System\ewuCVMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qptbmWz.exeC:\Windows\System\qptbmWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qubLxoO.exeC:\Windows\System\qubLxoO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51a0047601d8611e61e69350f657e6f28
SHA185c60cf532c6d8a6d9651473eef5786a92160c79
SHA25683756167eea91d2b94a1a0688e6b3b90fbd6feae350616d445a0c2c33ba9e0a5
SHA5124540f5f9149a34062d278c1e2a6080c1f5b027b63dd728fd68430e33a531cfc7be6e97aa9e365025c48fac9896d6d17d9d69917e7e72838d0a558ce473b23220
-
Filesize
5.2MB
MD56ae8e3926593e737a07cd2ea77e0fe54
SHA1d5517add33a51384215192f89524b867e6c48a50
SHA2568ba39d161a5a1842a06809bc59fa0773d59566ac6535ac922a2ff17ae7370c46
SHA5123ea1d4524aaba87b16261177be91aa6e73f8f3550d4b5f559a1239ff6386016d72050f518faa00db54bb02096a93eee23356dcb600757fc98ef0a68f537c8f3d
-
Filesize
5.2MB
MD507cac703e110d9fb4c0579751373869b
SHA1ad3ba740dad76cd577c59b523a4dab0dca4eeb20
SHA256d6ec3bb8176e0535544e5780b7b02c3efa96ee294328acd8233e3d6b5b9e497a
SHA5124cc50e2514ff78785bd1e515c427a26ed165a75d6b13b06fa80ea6306aee83558a9dac5448113070f201b1cc41b922bcb2c94066b8bc88abd74e72953e69f7b9
-
Filesize
5.2MB
MD5fc7ccf2b7c19c61956cc015595ea3675
SHA1e3e64b85797348024de32719a9e8f4b2da6422ef
SHA2561eff488aeb6ba567013583520736b5e074abf50eb288fd915a49533594170272
SHA512bcdec8c878c69d131730a0fae1a51b0e643359cad0f0e05c6963e5d731d81190eb74c635d9961b0e230da3d064266380e9708cb4e7801ba89f389ad8a82843fb
-
Filesize
5.2MB
MD588e8f420e88d62211c2c582fd715ed73
SHA1175d4a9e8867d5a4b6ec28fb3bd2cf004d873989
SHA25622d0e00279243745f5b2fee098f4fd069dc14529fa705d39b43ccff7fb8caa9e
SHA512cb0a3be81f31f4bf019d7a2e14a9a6b7b4ebb554467e0263a45cab191071560d560eb544a963c4981fa518d1ad465358fe490e9ba1e73aa28beed4b6fcc7408a
-
Filesize
2.1MB
MD58bcb05d9bcfba893b0c9a24fb80f6614
SHA15787929aa9a028156eff17f3dc6b3534a614751f
SHA256c2b85fec940454260304826248a9c8767c8fd8661f4d8f9df2d49d53f354b177
SHA512cd49e4319053da319c5e4d9adfd75fa0a3fa018ac7044e6437f9e748d51fcc424c57ff6b17d63db1f771e2d6057cb98e8c453c049529195658cea1958c0e6804
-
Filesize
5.2MB
MD5f638c33e4339434eb6ea0009e4ee2063
SHA198b52b647ac0147d10cabccc180fc479e9fc5bca
SHA2568e2e1c9dafaead55a526e3cd38b9260d5052f289072a7fae394f84db8a5acbdd
SHA5126da1102f76a5778bff074dd5d2f1435bbe9da8dbb018c7e30ea5e63415fa0c37c536c9ea95e159303026d825ee6a852dd08e6c1daa61c8f757620d2f8ce8ff2a
-
Filesize
5.2MB
MD534ee7b80d480e878cdd0752548e1e5e4
SHA1bd71e3bbf5c579dbdc698668a32a08c10af210a3
SHA256dd7cc67c0b3317c94bfb0eb96de5d4280b6882f859f50dcf9cb8eda6b748117a
SHA51205fb107cf12ddfd6b2abd14ffb89d860f20c768c96348de27bcf73e382d271373666fc1b96846447de1737fdf368615930778b20432f0a6f13208010e1169046
-
Filesize
1.2MB
MD5dfd2c67e54cfdf354e8bbb29e332ac4c
SHA1f24c275731b407476a6020a51b76ab1e2e179598
SHA256c0be5d6112649ab730dd260148056a01227d051b9d17131042f6515fe6c2f010
SHA512deec41c10fe0e2347f5445324da636126b3be5f85c230d035d5b6983b80abdc078e082d7a6098e2344c9a31a02e70ce3299e88c86063ee89cb6f4bc8de2697ce
-
Filesize
5.2MB
MD5c896aff36ae15189bd151386dbcc0d2a
SHA11fef15239b2c6965a9aba85b3ffed2975b913e06
SHA25613490b20bcf7a9c29b3d924906c2830e06c5ea416db703813532cc8665f83a5a
SHA5121ae382bd76d96b6cc2afc52ebf9a7bed10b4ca9b6da7182342d35e08a12506deb52279991ea536265400a636b57cd67de8dd479d28ce5b0f296bf6bf5e2c3570
-
Filesize
3.6MB
MD5d84891106dad0d7b4c34af85835ec4a8
SHA19665f97e962cdc4144cc100086ef9767ced5a5b4
SHA256e8a5f91c8c2782a6bcd21f33eab10bf4224beef644a32d7ad28b3f57f788882d
SHA51299ae93fd510de7cfcef873c985249199410b4395cf47a95aa3cb62c05fffe82e1b6c91a6f0f0d5f663e3d94c1f85eb70bf420495bec4261acf83c98b566255fe
-
Filesize
5.2MB
MD5195ce6910a886350ecbe6a58daa3517d
SHA1fb547c21c122d0a2f30ebab6f5f016bb3e51fc6d
SHA256bb01b8d292cd3715a103bdb23a35220a5da22230ffc73f39f26bed321da1ec97
SHA51223765276ea6b1a2621ced69d382db6669973e7092e8e8d6d49b5e475bbaaea8cf7aaebb913a275db5252dce7a5e86076dd00a01f11504722bc723d50725475b1
-
Filesize
4.3MB
MD5a13a8d0815d860885bfa9dffc2cf3f43
SHA1ba8ed394c789c67da35f142462ffcb146ba23145
SHA25637801cac559eef09a2eafcac36911ee601c76d10a22a1e9fbdc475bb69ec2fef
SHA5123e6ab34661d36946a5104f7f4a8797aed42473fba76921631e0d5bcc8950086db5f33a7e5f5d3fd5d0a18aeaa339c59a05dd30cc8cea91201cf5cf9f392095c2
-
Filesize
5.2MB
MD5887c4db9c0e731c51c424f25723ca01e
SHA1ebd4d0fec45790285506992b629378dbdf685bed
SHA2568bdb3ec24c554b9ccb52964f39def71f5534abceb5aec814c918cc861abcac4a
SHA5124a80f3d26dcd27c06e3614db59a15e70eda0ed392fc46dcf36320375a85a950d986e150e3f8fe8e6a084ee6d8c9d3a0a1c85df0e3bf8dc0563096df42e12868e
-
Filesize
5.2MB
MD5c75c795d510b861f9f9b558cb79b1fbc
SHA1d5add5618e5c3a7108967d8d5b9c9510ebec09aa
SHA2565bec47309a6327ce4ba19196bf252a4b51e899e3d727c2dc2a100e252a0eee08
SHA512c50063c1c71134f748e573d171811d1f33c168aa105479f20b41f27a816d5fb101e3298bf4d46910a258d07a1655cf0eabe4dc22c77b55d3371cd2a75f6a17b4
-
Filesize
5.2MB
MD561766f9cc12cf5573a414cdbe6b61b16
SHA128729773373596d9f584514c8f67e595dadfb7e1
SHA256ea519d1ac115be7d6b82e6719d9e683f74ece818f62f43c303e9387ec35a764a
SHA5128d298316114fb9954fb0bbef0775301287c93ff0e7dce1c95a94e62f06cdab3043b842cdff9f347f3064fe87bebb71640c309ee589364844d0eddbfa04acf432
-
Filesize
5.2MB
MD56eb84780ec578014fd161168296e315f
SHA10f588f5efd7eba784fa3acfd7eb9bee8effcf279
SHA2561df596e4eaf10d43f9dccf220096764379b5ce8c420de814644ae91c64482a2d
SHA5127197619ddebc22e6fbbf209701e46c0bac88b967f72e604babbaaffe6e5aa0d17b0d6bdc5da7079d142de6e8ed7a5dfa85e9faa917239010d3e1592882be9149
-
Filesize
1.8MB
MD5127fc12f6faae6241480d3135e552500
SHA1801e5edf3a087a26f7d10e6bccde102f07d029e4
SHA256825915c16780b599c32204b48d20a1fbcb4baf2eb57960853aa1679574121fb8
SHA512c859058e54b6a916c73c8cfc81b0347195ddc770d4112c2189cb2dc9a6aa8574b3ee3ca67deb659ca1901ed5c0c543ddc2ed6de390260167651487d0bed263fe
-
Filesize
2.5MB
MD54302e29560732a68d4ff81b99a9a6728
SHA1867d3426704c9287d13c44a18f34eb929d02e60f
SHA256eed7eb266aa3940308760212ce5afbae4e7c432894c30852d3d1775f4c7eed6c
SHA5122ee8a738ad84db753abd103ff3d354485aa1cf9e249c2ea0fcf0e26edd26120d75a4c9186760b250295587218a1b2d94c1e8013658858f6ad83769cb8dd4057d
-
Filesize
5.2MB
MD53b1eb838a01fe1e43ca67be9e0326b86
SHA1413824f1385e11fcaeef554eda4421930a30fe99
SHA256c16538f5b7602b3a7801026403f451d5591c91bac592090cd517ad0412b71b87
SHA512db1f24b7aef29bd9a61a5ff8e0815d33e2d1d85f87c5666ac0ef1bd01949c0c43a2cf24fdfa9a91e787ea234de34a490ea76c280c4f477fdb150f06fd0240d9e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB