Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 02:44
General
-
Target
2024-05-23_091b914ccdf9cefeb659f95d68404b2f_cobalt-strike_cobaltstrike.exe
-
Size
8.3MB
-
MD5
091b914ccdf9cefeb659f95d68404b2f
-
SHA1
fa6564684573dd962d1f47344e6ac108ee48e417
-
SHA256
b663f4049653c0d99250404911288f9b4ed42c13ea3c26b61efde8e38d5deb04
-
SHA512
5035f7ea350ddd547725342a3edb21c83c3f05c2a7801c32e9e6b5438041e53faad68161517756e5000b4aa313a2e82a829573233c8d71aec4e0ade313692613
-
SSDEEP
98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUy:v+D56utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_091b914ccdf9cefeb659f95d68404b2f_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_091b914ccdf9cefeb659f95d68404b2f_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eXNAdre.exeC:\Windows\System\eXNAdre.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zLLGRip.exeC:\Windows\System\zLLGRip.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\Zlbpsyb.exeC:\Windows\System\Zlbpsyb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qdCOoLr.exeC:\Windows\System\qdCOoLr.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uNABOGA.exeC:\Windows\System\uNABOGA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QCaQufx.exeC:\Windows\System\QCaQufx.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yaEQSaC.exeC:\Windows\System\yaEQSaC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LapOmGA.exeC:\Windows\System\LapOmGA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\SKisAwP.exeC:\Windows\System\SKisAwP.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CUIgTlA.exeC:\Windows\System\CUIgTlA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OlzCsHk.exeC:\Windows\System\OlzCsHk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\dLcfJpQ.exeC:\Windows\System\dLcfJpQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OUclamA.exeC:\Windows\System\OUclamA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zgdYSLt.exeC:\Windows\System\zgdYSLt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\mhiFdzm.exeC:\Windows\System\mhiFdzm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TqyIzgg.exeC:\Windows\System\TqyIzgg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\dpPJkWo.exeC:\Windows\System\dpPJkWo.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qUemRfj.exeC:\Windows\System\qUemRfj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RHqTlVO.exeC:\Windows\System\RHqTlVO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GUgczEf.exeC:\Windows\System\GUgczEf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sCUIuvP.exeC:\Windows\System\sCUIuvP.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD553179c422d55e05b527f06f369c3767c
SHA1ccb9149096f73cf2f9bd0c2bec1c049bd01b7107
SHA2565edb7d10e7af07fe529ea6a5c4eb85e86d5ee2626318b5fe957989b8aba55d03
SHA5120a2ad34977fe0f845cdf88216d43037d4b084f17466bfdfd92ac37e6aeafba9808c5af99f8af9b1348912477534510f9499ad0c3b94bceb69824b191e6112cee
-
Filesize
8.3MB
MD599463cae6c58bb43b1cc63486f07d206
SHA157b800329e1a30002c8142c816e9021bb437704b
SHA25627e84837a93102bfae8557d74e654bdc841087326f642d0acda8e7a8ddfa0fc5
SHA5123f9c300a613443329252463f2a648656b04275a1dd0a7d49e6bca28edf6a9db0185e1cc1a59286ccd4f7f1d2e754988f8be85c411241a975307fa10b0e867dcb
-
Filesize
8.3MB
MD59b8dc50960fed23c674d46e10ce2db9f
SHA1597a589d2c6bc31ab8fdf693eaf0af589343512d
SHA25682d445a532c2be09056134486ad84249747e6bbb01868642310e24f465c84db4
SHA512ed01e8b64d9151ec5d40d033dc2ddb879877f34742bfdcb7ea2c0b47465bb195b16355a41406eb60800350871903f14958369f730a88d9b9c79cb0b3d2eb8ac5
-
Filesize
8.3MB
MD5355586f22a11e3947442704165496cd4
SHA124399e57aabddd2cd47af8297e488a227bc9d1a6
SHA2566631ac307b02114eecab726e4dc9c989f54d355c551cac42bc47d517db3c678f
SHA512e5b1eb5b82de5527f8c2f1b473a9249225a74c4cc98c309a401a17b12386e9ef09ee2b676642711e7eff25eee0f319b2ec2c91b33d5169d17cdec11b2963fe8d
-
Filesize
8.3MB
MD5c317cb2346f757bdaa2ad6888e1f7f33
SHA1722ad91c69523707ee4b10fd9240455117deed37
SHA256c1d6b0f2b7dc444be78ecc4f4d857b63370139640372fd729c85c65a592a9aa8
SHA51236a7175a455585461e9881594b2dd4f92bf0adf44db326a6ed222bf5488aef6bc1dc7b9e53aba2024098836517594ce96da7fcba8291be0bce878d64f6dc3795
-
Filesize
8.3MB
MD5bd36adf674779e6802e7792291035261
SHA125260f51128239c5144bd5db4740e1c622f08612
SHA2566cd5940034273e9981aecfbcba1b4f517df82f46a0911d8b08e9b095367a7bdc
SHA5120f6cd2c700d39599561ce6cf8851cce5c21722820d6a03f47b0a77b2c81fb7034bd9bcda1f6681c00169e060a50426b8ccb6bc1f97f7dad9364d2430800d8882
-
Filesize
8.3MB
MD5c1ab556b592aa07aec27f4c3d0a7bf04
SHA1cae8b1a9f8dc1025d38e4e87bd126dbc30c0b424
SHA256a3b1e47652a6c7b37e34c3ad8f52680484e9400676a9c908110430332eec520b
SHA512026a61715bd2ada3750a775db7360cee9b626470a019a39c80ae0b91ef3aee7976483d32f343cd5a5b9c70e2434241bc1368e81d89403f773e982818e8399e15
-
Filesize
8.3MB
MD5182f14d1514571e118bed959b1ff56ff
SHA1c8fc1cbd00ff72d46f659903f41c1d2d9882d5ce
SHA256c0e84448adc3765edec4b75315c3e4d88546bd1921715f7b287c6583b0078223
SHA5129af96c021e7f119ba8e811becb06f0831d3c0e3a46c5cd3b840a41b2d5f4923ff5e85eeaa512652dc45ea04b3bede763d069e278594bc9324912149194a20641
-
Filesize
8.3MB
MD55a97b2d76cdd464349f42ffd116aad02
SHA15e32a1b35483942f8fccae77fea38ef1d8bb6c5b
SHA25674955a4bcd1746f4b8fea6f1162ed33cd1fc9327a7bd7478a9e8551fd00a3b25
SHA51230af07013825e22bf6f03eebb824a5e9a4dbc46d2bdef96219037214f09ac168d30cce9e1b15a806ba43ada1a131104639a4468936563502b0d8e77839912a18
-
Filesize
8.3MB
MD58877b2105b42c4f37b85644bb867a9e6
SHA1c3803fe30c0df5a4c36471bd20bb94fa7ab6b7ba
SHA256c0644cea74a6610ffbd3a7246344d15ef62a6fbe9e8dbe70a33aafdfcb62ad10
SHA5126259a0965bf9ae70318efea7a42e9c068ada997f576ffc82e0c0726d3f37987fa5f2cd10dc65c1c989940074405e674e2b88a68c023dd6928db7e39b8d461764
-
Filesize
8.3MB
MD5e1560dcc5ca2ac4a42c2009cd86ac3c2
SHA1776254b8a70cdcb7d1f6146d705fe99979d300e5
SHA2562eb91be52dc0abff64de431cf92ef4bd438d41711559e7c132fee8f00282185c
SHA5122155d1cb351b53e725667f9d5f33309979de35026a15842eddd73854c2ac49329ffe30c70a1b30d4f1a6a0ec6fd2dec862397e16fac21ad6f40fc34b809a7826
-
Filesize
8.3MB
MD53c19e8146415e66dac1b73825f096ef1
SHA11152a3b8b766b7b52f1e0c966f16fd82d3e96ada
SHA256752adc2fdadfd8d27bd325756dfcaef75e72726d1e680bfa826c215078d697f0
SHA512d79267bcabe023ea4ccb2320a2e6fdf01154ea26fd9024d3956e7a6e5e63b398132e7d6779db28d91e6bf96207d1cd1ee7647879a465b214112b15c303564a2a
-
Filesize
8.3MB
MD526d8bdda7d14dd1649c859b8eff2e36a
SHA158fd3aa33cdccae564068a961c78a1923f67d905
SHA25659a7b9154f9a73da11642f3f3b3ed8744eb5460cd5f9183829cf7b93ec3a86ae
SHA512c988e11e1086987763cfdccb701f1365fc81f0afdd5bcb9c82bd019af0d5c33dd873bd901fd6a72f61d4ba94566b728feb6340133497da913cb29bdec62aed43
-
Filesize
8.3MB
MD5b1066ab891e2682b1c92addc0a4826d7
SHA111de5a64f334af2cf3bed17cfa5d9789f26c0a72
SHA256736ab4aab12b17dcef050b1974d7419af41c3e89adc73e125f4cb1a6044ccf35
SHA512c18f4e188598ca2fd6d5be85a457b9eca2248de93ad8959f7331e5b1585986f9fb6fdf6195bc8ffa1e07e4b7c352606abd5245ce645c4cfb420a687e3a4cc734
-
Filesize
8.3MB
MD5caac07720c2daf8a6227329f90a98fa6
SHA18a5ed2b94fb2af1826a6bc5b008fbd6ab5b7d332
SHA25601498bcec5336545b1626d402ff9a327cf6c57016abb73a6fa6b1d8916b2be58
SHA5122a31383615969ba25ff80214585b2a6dd6e0d70da4a00cb63ac59de23cee1d31aa790bda427af07d1bf78f3177df5a4ff138323efdc96c8071519623e4e64f21
-
Filesize
8.3MB
MD53a311764e79e1403e6e3652e2a063893
SHA1060b251a8bc506b18c52925a8f62927d9e3bedd0
SHA256f1178b22c75b30344729c759f41f83e407d87bf46118b663014fe8c5b3ec8eba
SHA512e88a92ede3cca2414ec05cca4f02b8812b0f63621db16936bddac7eb92dd7906b34b62d0736241bf8b150b038e1906e9beba90628e860374f873142a758032d0
-
Filesize
8.3MB
MD5f190c29137388994a3d709690b2f727a
SHA1ddc90ab2da36668bb5fca2cf2970cdb222377807
SHA2561c136f7f7d717cc6f5a1e4119276d6669ef0a4af42ad5f3e6f3d72ce2ae22a70
SHA51266ac50f7115b78b04b7edb794a376bd7ab143a35dc1ddf3e0bcf9155782cb47dd67278c6863d9c727096fa6b22b755b68385cb74f98b33eadc0ca87b29c6857b
-
Filesize
8.3MB
MD5e2dfb6ac948cb3d9a3990054616045f6
SHA11f58b4fb4f25641cf22dc03dcb6aa196a11145d3
SHA256e56a7c4f06cb1c4abe3ad01bbd266d2dc7a9d7df2eedc7360cfa932206dcbb63
SHA512bc62ebbf84fa9b1363ae7102f339ae0f3badf9799016e5a4cafea34a322236facbe2e3fd473cbb77548892ecc32d015bbf53351423e470e59210b84a9a681d06
-
Filesize
8.3MB
MD51e429ac6e8f6d956dd445d179f23e176
SHA10a41391898e6c81a7bf3d685f8998f5f50ef081d
SHA2562c0fa67f5911bf1da9e8ecbf47a61a83fa07a5d071b76ab68b2ddd5b2995c6d3
SHA5128fbec91bca817398f27570a066b9ddd73bd6d9ba9bbe0df7d338422c9e40bc96ada5ba07e7d1e6e105f5ecbcda7075cf233b41bac0dcd845b7f8e9c13f23c4eb
-
Filesize
8.3MB
MD576dcc2ff67c9ec013db67094acb5ecc8
SHA1728cc456987a227522322fa94b09c0421a78eafa
SHA2569f27dbfc0529bdd8efa340c2ffc644c3428813a199471e9c9dac48c49716f70c
SHA51206fa1aae1c9108e241cb49ea1765f7e0a21220e33fd7b35840a7ee68bc3fdc3d79386e54739861e8981e914223f818d3ffecbc0ccb25c0e5e1e397c43d1f7251
-
Filesize
8.3MB
MD5862d67561a507e93beeb359df69f9cb4
SHA1c8b86151bed6f9666fe0fe889e2aa20208e1adc0
SHA256c31f4636811b474a386b63866be1e8e259e9b4d86ec2d5eb6aa738c8ec316305
SHA51279c0234e6ef6a5a8cb3748bdf2ff1efbb926986601f45dcd5457284fd7aa547b300730d70bb9d37dbb542949a859c190011448887be82d71bb9b755f1b1c34d7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB