Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
23-05-2024 02:50
General
-
Target
2024-05-23_721496e3d8574d3b36b661857b46f56c_cobalt-strike_cobaltstrike.exe
-
Size
8.3MB
-
MD5
721496e3d8574d3b36b661857b46f56c
-
SHA1
c416e174f4254b308a5f6735a79777045f18fd71
-
SHA256
8ea8d45b8ddc09fe5defd1890fa1e0b6c70c202f6a2e1e60b75784cf8cfbc72d
-
SHA512
2a69526762649b91944f5a7723cd290565b38c223844d4631d686b6ea391527168e117859e1d16c409702452816092e810498d2f710cbd6bf18212284e82e0da
-
SSDEEP
98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUp:v+D56utgpPF8u/7p
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 52 IoCs
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_721496e3d8574d3b36b661857b46f56c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_721496e3d8574d3b36b661857b46f56c_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ewZzZBG.exeC:\Windows\System\ewZzZBG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gHDMcsD.exeC:\Windows\System\gHDMcsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gcamvxf.exeC:\Windows\System\gcamvxf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfpiqEi.exeC:\Windows\System\hfpiqEi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkZbnUj.exeC:\Windows\System\BkZbnUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xXkXEgl.exeC:\Windows\System\xXkXEgl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XKgJnfy.exeC:\Windows\System\XKgJnfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdDehQZ.exeC:\Windows\System\AdDehQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIooMOt.exeC:\Windows\System\RIooMOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sdLwFIk.exeC:\Windows\System\sdLwFIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HMPvIii.exeC:\Windows\System\HMPvIii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQTaoWb.exeC:\Windows\System\YQTaoWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JdCHeDO.exeC:\Windows\System\JdCHeDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHmmTOr.exeC:\Windows\System\MHmmTOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\miktGeO.exeC:\Windows\System\miktGeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDlMrpP.exeC:\Windows\System\rDlMrpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hglAEAd.exeC:\Windows\System\hglAEAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUHLusk.exeC:\Windows\System\LUHLusk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igGrXmh.exeC:\Windows\System\igGrXmh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAFvXiv.exeC:\Windows\System\eAFvXiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lBKqHXG.exeC:\Windows\System\lBKqHXG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD51047a10abf004eff4bf7d7fb168ffaa1
SHA10a48925d4595c9cffd115e86332b1a225825f431
SHA25609831d9f7de97d778283b8343e38f803322116c4c34df4e263d503a483390a64
SHA512d1b839e52071b66627979263e03a1bb2e2eee692f93c496932cc4c9017f8831857be168ef794484455c4d081c35341e7d944b82e0f896205f0c6593b5ee888d6
-
Filesize
8.3MB
MD5a2b21b59d5d3effed3ca24e399f8e353
SHA156866ac27a398f58cfe77612895003db970a5516
SHA256e05b073abed5f759cd24d59728fd723762edff784ce8462ad47082b348c83717
SHA512677134e78418e920e723dfac3102850be7c850e18cee6acf928cbd19538dd607b602344c1e42400098f9eb3f79e4c07b14d5bd513d50dea20c11e52a73f68cce
-
Filesize
8.3MB
MD575b6fc6a80d0c506804c5cb13ac6f4d5
SHA161d22d1007107eb9b0915798c2d5bdc92b60bf68
SHA25633e5e4a89498f7ee078b14f995623f2739aae6e53de27ac427d52d3cb0c9b2cd
SHA5124a0f37a2a92701efcc13bd16673d984c9afb666c2f874c7d1264037dc07bcb3691de62a15cccac823d98b5dd76dc576ac0ddafeac7a001a9c55fbbfda3a29c69
-
Filesize
8.3MB
MD5404509fff01ab519149c667c7e09fa59
SHA1634db5123d94c81e53b37b517b6043c1c6acb8b5
SHA256345e1e7bbb750a19bac09b487de36bf1c9dba36391b4b4d724370709cca8690f
SHA512b856f9cd4bd1cfeb1867d3ccd4a3ebbce9cac7781698ecc344359615c39fc539dc03accd4dbad6e221e26fb5fe71d591a683d1a76f74b4a977b09fff2a405d85
-
Filesize
8.3MB
MD5554af466581dd2391a59312ab0dfaf8a
SHA109bdf683422f905d7e65af4a8df73567be1d7fa8
SHA2562b862ea92bffa007eef19827404be590ab105b795c24c05ad61086a30c4eff02
SHA51278defb5916162dd7191c11bf3182c69a44e994d985710674e0c8d9c66f1edda3f62bbc70ea4cbf915f3cea25a3044682fd5273bcdac3516d583d9a76996b7bc8
-
Filesize
8.3MB
MD52e4f245392a3cbc85e0bda08753d22ea
SHA1ea6a7a4b31f0f31f25563d55060f18ac2839cdee
SHA256f3812a5f378f567fc06c7e623cb1f149be78f7de70c91e9af0d294296fe6e1c7
SHA512ad368c056fb886c7111f72ccf803d3c6156328fe0339e480941ddb8727eceed1162b0945fc75e2e2a9cccbdf9bcf9f1e76b5d41e5a89f3edbc2c69afd74ca461
-
Filesize
8.3MB
MD52f7067698014c4cfd174ca5a3a8b5b08
SHA17a68caffc48e6fc160eb8a8485b4ce42e9f3448e
SHA2569460605c445402d69c0e96c2862de3ca93d7af55d474d18dbce01bf7c8704de9
SHA5123da8909ccba791210c67854304941cfef82bb624a57b89bc39a55b91f32d2724d0d3790b1f939df012092675a59300308f99dcef68a9946f3ecfad475dcd90f6
-
Filesize
8.3MB
MD5281de72c8f17e579c23470eaeae5db3f
SHA19f55928cb9da2d290f5dbc837c4047b667e2f1d8
SHA2566fb8b7ba39c1a13d3338398053d9583bd113f4c35d182258cfaa3aec65f635ae
SHA512fad0ca6001f78beaca40a7a13c957af07806f6009350ec25c1b9c51200644f0642607671d8d068c5078434b6adb2127d7034b2da53f3f10c2fd8007afd463339
-
Filesize
8.3MB
MD5adb8cc5799a9d9c63524716350c5c75e
SHA13bff6c7b5c3f14b8ef56ebb9586c05df566b25c2
SHA25651c51ac8fd8018d14fbc38f0e17ceed37e55dab7072e694a4852b7bc106353d4
SHA512dd0914d2640966f120b8ebfefea7e18152b3e7737dbc1705ef1b49579df839fb789bad62506e865bf2adcd2ca6094aadff774f60d14dd3b93788de7feee75967
-
Filesize
8.3MB
MD50de5fedc100675b87d4745590c2e7bbb
SHA1b9f7ceb7b6a1fe98b283f8c8b8562a6fd4dab06d
SHA25684c318d0dd6312790135ae7113e68d92e8dd4f18ed472009c6f38bf01165cb31
SHA512d9e834bbc3b0736c806b3cdb251be1abd4dc45def638b5de065cb85485c842e565075dbe19f8f615ef56f4db2c14b0ce62311199612d9c4f8e15a52967c65723
-
Filesize
8.3MB
MD5065f37ac7e0d6e2e075a1850beab7de7
SHA1d07336c730ef3d21834019f39a3b2013f516c3f8
SHA2566058b159081166341191c2426bc7664bbfce10c6d3a6ce5813bc6854f6721b4a
SHA512fa46a235f3f52a9ce6293c62e4ec0f8b9e11ebf77298e925cb6e380bb6b2ba89e19aa8d4506d6fb1ab5d49af23b5696e5553d095918dd57163187d32fb35ac7f
-
Filesize
8.3MB
MD56cf08f409704321ebee59ac96f0fbedf
SHA14d57846366c775923842718fb60a9c6a2a4b1dba
SHA25688e24fc49830e407a4393754b64852f05fa83a2053abd81aaea6264287942f3b
SHA512646142a92862b936ec11612c45da5adfa8290eba7f0e91a6adbf41b8b77a8e9ddf35ee57f91c3b5d8e872bc188f9f438d609df0c59e98d8f8fea67e84b9dc870
-
Filesize
8.3MB
MD525340a763722513869f37009f0a33a06
SHA1618f653b5c899dc0f24a9297e832554da8b649d2
SHA256a7c544c8d92c1b6c41d0d12a8e0e464718c0c272f8a6c703de1992c9b66a6d37
SHA512fa8e7eb49465059e56bd3ba8597b0c2d830a72b3c5407e9eb294af54147d0e6ea6f9242fb580f0e884fa55393c6f8bdc2496401d60a0686f86f84dd1f8892392
-
Filesize
8.3MB
MD5ec3169b3e6a18673af10a66e872095d1
SHA16de02cb976b6380bde6853baef07ac60039de814
SHA256c1b5c9f190c8d7998969aad1d78d2ddadd17e4b14c1d37205ec7319e08f413e1
SHA5120e437fda8cf2a7bf3921837611bea56ac82c6574d662cbc9d4603aa9b95c09093d5f0904ffc354e544126391356610aac9e5c4bf5213207061a7c09ab24049e0
-
Filesize
8.3MB
MD5790a0f04f377f9cfa8854735c36d70b6
SHA1c311eb24403abce50bbc42656638abe8792a2640
SHA2569437a39d68ad25165cb3281dee4348e5e36f8a3757847dbe715fda6a8bf11817
SHA512e2378977285604da77d77fffba14e8db8777b88c8d930ab8c45e06045022457a042d6fae6b07214bf0cfe7181930cd50e3fe1c763ff4b5ad495d56e990e2caad
-
Filesize
8.3MB
MD573a3a5c7e786e03137331fb28a35845d
SHA16fb2f90c1a0205ee99aade662ffdda22ee702595
SHA2562f90a1a462044f4bb8e11d2b0b65481ad2395cee4585bd1073ca15f01dc95270
SHA512d2d1223d1e645b3e904e67ce3e3d5c3bf2c72abc209928a75c5f91285a9ba52c4546e48fa3b07b34c6797c58ba773a598cd63d482b4416eb314aae0109c8d130
-
Filesize
8.3MB
MD5d553c2c599c95dec5f29c79da3536609
SHA18c4eacbcd4eb439868caa8471d98e7b7150d971b
SHA256ec3b7e873fafce47fd1b3c712604f4375aa89e2fd5bdb87b3294705aad259bfd
SHA512b6be49b484b64ac4955f3b4699c880887281b7c51d6880071cda73322a0e984fdc637fd2a0fad76661d19dc300e9e8ee8fd47bc2bfd596aa945c887f433449f5
-
Filesize
8.3MB
MD565f29117bd3cc6057240951a91cfd41c
SHA18a96d3283db99a459aca81d2d46e0e4fbc090c89
SHA256daf1f43a304c6b1b286a3f9a57471370855ad322aa3f7f1acb2c0f139e458c1a
SHA51220b72d60b8fce6b46e3b99406ee21fc5dc7df3723582489a21e1bac151a5b867c7fbf2d9c8aa2593bbd6f1748a39ff4c6006f82dbc3c874f49faebbd844df2fc
-
Filesize
8.3MB
MD5fada52185f189919994f6148728f1893
SHA1869519cfcb9f7e34a6f9fc54678d946238de3eac
SHA2568b6ee19aeadc26c7513631c5f95cae863a61385bda1f0caa6883f89b12f2a079
SHA512356294e6235b57dc6e649fbe90102d99e4395e622a3856fac09345a6fd0e62c15c1de29e473c4e782513bfd5ce366179e5cfbb9eb6709b808b7433816dfa09e7
-
Filesize
8.3MB
MD56657e49af26ea4272ee8144e89958a1c
SHA1dda6fead9487177e4046d173db218b4b9b80eb37
SHA256f32a3755560f58456f7485dd192e32e5ce9806265c1278ecfa8cd77c8e49483c
SHA5125f9901fea587c1760d868e13b54b1f6a1ba2aa70dfbdcfee87f4893adf7d25a79ee63faf57f3250e890d5b379eb5c281ffdfab268a1c13998c27c1240a77aaf2
-
Filesize
8.3MB
MD5a54a53ea52aba25ddaa4ebb4bf3915a8
SHA1b4cca6cd565cb616cc8bf077eac5e7abbc4be387
SHA256a860ff75192fa0c5a2241f485c127a5530453e50a7682bac55ee12aeeff0766d
SHA5126cb0e271420fc1a3ee120e787b84a50f9110ab07b08753c1f134e7dd789c2b0654c3ef426f8c7da51dc11962869a6410abb3d71199b36ed6f5340f46b755e25f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB