Analysis
-
max time kernel
135s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 02:57
General
-
Target
2024-05-23_9692994b50a306dd8b2c1bad47b972c5_cobalt-strike_cobaltstrike.exe
-
Size
8.3MB
-
MD5
9692994b50a306dd8b2c1bad47b972c5
-
SHA1
66618ae1d2bed409353427dc1d778130579edf6a
-
SHA256
0bfe9cfe6dfefbd8635bfbc68205f6e76936a791f0bfe3cd721d84e874745b6c
-
SHA512
214db3da293c0480face79a8696af41d0d086cd42807f7a7ea0368d97ee0cfdb63f5bbd252a1776e1a2096c4a5bb56c6944b8f7041d980d567fdaefd4783b0be
-
SSDEEP
98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_9692994b50a306dd8b2c1bad47b972c5_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_9692994b50a306dd8b2c1bad47b972c5_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ePPXIDU.exeC:\Windows\System\ePPXIDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TaxmNBu.exeC:\Windows\System\TaxmNBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqUvGCF.exeC:\Windows\System\VqUvGCF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cFwDNeO.exeC:\Windows\System\cFwDNeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvKXvOo.exeC:\Windows\System\kvKXvOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGkLPeQ.exeC:\Windows\System\wGkLPeQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJpFqTs.exeC:\Windows\System\lJpFqTs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsBgyZy.exeC:\Windows\System\dsBgyZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ioXFFjO.exeC:\Windows\System\ioXFFjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRqeiYs.exeC:\Windows\System\NRqeiYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwXIswR.exeC:\Windows\System\gwXIswR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddVqmgM.exeC:\Windows\System\ddVqmgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONtGUdl.exeC:\Windows\System\ONtGUdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZnummp.exeC:\Windows\System\MZnummp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssQDCve.exeC:\Windows\System\ssQDCve.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZLrZHgz.exeC:\Windows\System\ZLrZHgz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFScPfa.exeC:\Windows\System\rFScPfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypVyDQe.exeC:\Windows\System\ypVyDQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgopZRx.exeC:\Windows\System\vgopZRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkcXTSP.exeC:\Windows\System\fkcXTSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJLfXjr.exeC:\Windows\System\JJLfXjr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD55b4ab42cf52175826a30703f623897b9
SHA1c68e2c10a9240de963e49a4b9df38127929b255b
SHA2565fde8a97aa9d02d147a64a1deacb728d115e8fe5fc0316557dbac254e03a34cc
SHA5123b00f7c56ee71992ccc72330a154a08153b9c0ecda0846627537a5dda04d77068596760ffbe369c30f390bbee63a8d2309a4f946e3bb961c58493292e9953aac
-
Filesize
8.3MB
MD59b12e3d53e60d7058ce123b43772c9d4
SHA1ac3e0ed893a746d1561a0c0ee7c2462dd2cf6973
SHA256f3b186cc8a6a12e92ba1dec561d483b01b63fe18a3d22a6eb72ad5fafa533b94
SHA5126a7fe61cfab51d121bdd13b68de71ff51dc581000f25e833c12c9b5169f30bc56eaf83cc15b53631b2e8c01e1e160602110c9f4a09a9202a0a7f2c2dd014a236
-
Filesize
8.3MB
MD510f219c7211da9d63a85ca469ebd4e5f
SHA157d50e0098b4a159eccbc6e6cd809a1913cf8586
SHA25689bf51c0b20e101d10d87978b397c04d0c7974fd25d467748505090ae27f6a5f
SHA51268b1cc9ce7aa6b4ca8199a1caaebb89d76795066d9392aa34998cad7c4422a74dce73c78adf51324e0888df2184e2c5a0be8b5ef676b6b02aca7fdd275d8a3c4
-
Filesize
8.3MB
MD5df91c4a8c16f2bbe72c3ac9a2d91103d
SHA1305dbb489c211049fe49e19d25fd9eb7a834d55e
SHA256067e128493bfb95222a489a8087f2e036cf9cf444a3e8fb400a99297d3a17623
SHA512353d9eb019427389fab11e10a62a7b5b8117757b36ef1295acbf5476d7514c98fd79e23ed456cd60d22c90a5eedc75762c4a4ebe36b801b190135320d86a71fc
-
Filesize
8.3MB
MD5c97729b93cf2fa61a1dfa13e79114f0e
SHA1a6ebcb9b9b485a6040e3c7f4d32fb034edf2b888
SHA2568bfff931fde492a1872b9d788f554e2d6cc5bc2bc95bcfe5e47bf519b9b29214
SHA5123151b8157f16294994f084e98c42cb61b625c4bc6eb80ce43cdfb419d7e588662d9b040d05caf1c5540805977c4379080a77eb9cdad9236c26f3ce68c7fdb7d6
-
Filesize
8.3MB
MD5aa0a4410bf8b08638e7226b9183f24ac
SHA180460a2cfbbc2fca7655d18a539833a1ca6201aa
SHA256d639cda3bdd08544427168c848b53614faaf448e4eba623d2950bbe04bb87a2e
SHA51220c451d309ecee06a70d2f3658f0e73e8ba6f79b6295bc802a3dc889a08666dbf0f004023417aa1de887ca1a2c6d59ee92ffa4c0cd0a208b422f99a750e6dd96
-
Filesize
8.3MB
MD5d5d0d91f0a51a84ddf172c5d29168676
SHA153e100a0b975696449d490c8230d1214ef1a84b0
SHA25663d8eb8509c8f449fdb37b191f20e80a51c0b83256ad7099e917f83389deb7b0
SHA5126ba62d42262c335d585ca2b97dab1870d2acb04844843db7b37bdeed2412d2ff7088c10b6a9c75b609bef22e32cf8e47cb142bc557d6d16d896fd678a253feb1
-
Filesize
8.3MB
MD57b42a55a26587629b63f880ac592232a
SHA1a9d90ec0e3e294ebbb18bb17e09b13dc66966631
SHA256d0ab84d864ea4439eeaabb26d1157f0e71aefb775939e2801105393d37c2702d
SHA51292993ba270f939796e8ac989c2b8ddcac371a8abcb39b4cbb4a7048a577d903bbc2a8dbb5b14597ae513a99f08067d42ed7205cf5c53b8bad11c52ab7f496150
-
Filesize
8.3MB
MD5cdbe18346d139041ed05835f7e9efc6d
SHA14b204610c5fe1bcd4a73e7f9dd4cc698fb3d8500
SHA2568ac1f694ba65206e4553621e0a530296165f7c916cc38298f49ad7b13fd09cc4
SHA51232af75cc7c3cfc178468ef93b89a216927f8fc0b45d2f68a140693db4d4ad963387d2b3df46a42f96842f70a6873c2de10f9c94faadefb513d309e6e51d6aef2
-
Filesize
8.3MB
MD518aa81b124de0624be1eb54793b15854
SHA11747ee6c7019964d48a9bf1b8591482ad89d9c83
SHA2562dbcd4081fcd60ae66bf477bd6ee3ec90bb93dd2773a896ee0c5e34703344dd0
SHA512f140c30436001f51ee6946a922be3e7849d057790beb19073af956ab06a01c12efc352464473795f9809548835ecfaa005d2944988b36957ee9b2d3a4e6f0720
-
Filesize
8.3MB
MD558014340b9691c753b00dddf9d7d55de
SHA1956c8ce97336accd7b8cffb003a79108570d685b
SHA256422818d93a29dcac07b9bd7a2ead63694719f553d14dc74cf10f64c49fb122c2
SHA512706d123b742850f65822f90c124f264516334b7bc0949130372c3cf2a82f5c68fc1368676083f533f5d0b4f1d567ae28da28e184a3c5a46b9bf397fdd5fe7aa6
-
Filesize
8.3MB
MD5450120e1cf4a57e968e82e2e07d6cbd2
SHA125bfff782ff2839d94245fc674fa55ab80a89541
SHA256f81736c7c7fae24e97a9b831ef794ff8864144b961cf4cbf6e1aedb74681f32a
SHA512b75de445acb1f0e73166a5c6de287f45db1be70f77c77ba60ec67ea7a9e7e928ac21d8b68afb5c78d8f5e3516dbcae20b9df815b1da7b46b794254a975576a1c
-
Filesize
8.3MB
MD52848318cccde8c1b67472429f53d44c4
SHA178fd5056964d67e0361dfbcae7f51d9dd496c760
SHA25693bc6829e890bfe7add3095cb1dcd58608b6107e5a02204955aefb7ddbae32c7
SHA5120c5cdfa8fd91f71ceb365aff6de68f664c6f05d4487257c913265e350f1885c0d3286f8ef814fbd204e14009d62e42a526def073e988b1766f671d6ea2fc498a
-
Filesize
8.3MB
MD5fd5c61ac531cb91b4ac9e649530c8160
SHA1faa1a3f0c5aaa7265f1ea011db955d256bab6547
SHA256df7ab19c3479f69d01c2469ad1bb3a55c639ba4dcd4bc2adf882e8d41a43fab4
SHA512d38ec564419f4c3f0870d84e3c1ccd7c3bf390a100e9e3065af61de1c6df521deb303a86f131855c1c6dde2bd2c2387b536ae8a2e86c7348e14895b33670ce91
-
Filesize
8.3MB
MD51fe0227d8b0b813689e536467f174c6c
SHA1d628f64db0faf9ae1c7dff19a6ed802a90f2ceed
SHA2563ad578fcc402715963b3afbb26357b23325577686e8d76ea72c030b3f1338ea8
SHA512cbf472951fb3dcbc6780e496705c7fc7e98a841549e7569d05755d965301ba4eec7b8b2a03131f85fa2f6297224523034cbaca753128c4115b145cb0155e735c
-
Filesize
8.3MB
MD52926f57b9d793ba5dbca7d30ce19d729
SHA175ff930f126ed36ac6f24e4efb8b5a33666ececb
SHA2567f4b922ce31123ac2095a2d91d9812c9c89e3d4ff6ab52b9285503b3343b96d2
SHA5122f539245e1683e9b470a17409090bec8a847a1c1a8b9bc379b2cc9c688cbe166e76930a5413f6b636737d5f707c5d13a35b3370b8a97bcb76fc39876aa633a0c
-
Filesize
8.3MB
MD58ed2c83e4bcd1eb6364c70b5803820c3
SHA1d025904a60415ac8ec4095f587a50f50b8f693dc
SHA256f186fc6dd9af3f425cbac9d9af797f973f1503d4ee5ff44b4570342ca31f9202
SHA5125891fb8693273d2ce2e5734f0830ccae6fb85d1a537013b45912c12996928c8c604f9d804bf61cc6bb6bf4775244cc20e4c13071027b2168cf7b687a12ad5866
-
Filesize
8.3MB
MD5197427e7abc53dab857b21cd5046674c
SHA17daaaed458da4ec456494969e4398a7f9b90b944
SHA256f07e0d53950dadb1315bd35df704656e4f2b02d389ce67a910e8a32f8d8855ed
SHA512407d8872a97d7dd96a53d456066267b2afe4f611635d1a4fcf3a6a061ae95228dfa5467d80ffce89b176ddcfedfbde28e07dba7c9c2a395533f60f531b8ce85f
-
Filesize
8.3MB
MD58f835eed0ed0db0ed58bb7bcba11f23f
SHA19b6abc3434944837b8a1851e7de06279ddc4e6e5
SHA25699fc86f9c6f9df10a682d785c728aa3bd9dd08caa977126dcbed6b2b1942a043
SHA512d36f93092fc55ef50e2ea8de22f099a1bfa59c738fa0320a7b139634a67648258316c05f183d77719a4ccc0aa6a2b8837ca59b3bcc9a94da45c6dd822ac5751f
-
Filesize
8.3MB
MD58972906d2244ce4d89c7313c90637100
SHA1c12bdc2c67be6b0d758707c3e7b7fb26dbf2d12c
SHA256f8a7d4482afdd3b87212605e2f2edf2c7abef2a02694320128dc2bf9025718f2
SHA512869c01ccc9bb9e424bc4c914741d861299b6162299349cf6a5c8aaa38e642e02310bb0248c3c8688f1fc0059c7a2ff88218354644b23d286829ceb707de7a1f7
-
Filesize
8.3MB
MD5fff8f794f165e9be7f6a1e26c278241d
SHA111803dce9e7975ed5aeaee0d6abcc56ecfe8be97
SHA2561859326b046c49a7ea6a1559653d87229cebb0c68676523ccebaa5a1d81f8c49
SHA512ff270fb22e2fbb672ef718181ae2dc6b2f084c6c42ec1707539349d12bef8fecb4f26d76fa5616e2fa74a602e7698a4075ad900ce1934c526377f436bf02e22b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB