Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 08:09
General
-
Target
2024-05-23_993a9d59f962ae35f5f7a6cbff51ddd3_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
993a9d59f962ae35f5f7a6cbff51ddd3
-
SHA1
3a078439a7235bbd546e58f4fddc27521cc1b661
-
SHA256
e71e639032d251e8668f825bd7728779d4e13c540b5e7af56a00deed945638b0
-
SHA512
28775e88fc4a6c8f9dcacaac960aa39d7dc5edcbdd554df2ce8ca0a9509eb950c98dc2929419ada0195ad8fad82686ba3026cf89a5548c2cfc5333f33334449e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_993a9d59f962ae35f5f7a6cbff51ddd3_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_993a9d59f962ae35f5f7a6cbff51ddd3_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\urAZZmK.exeC:\Windows\System\urAZZmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ioahRoc.exeC:\Windows\System\ioahRoc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtjjvZY.exeC:\Windows\System\CtjjvZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HQlrVoE.exeC:\Windows\System\HQlrVoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CyDfMwV.exeC:\Windows\System\CyDfMwV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mewwYYp.exeC:\Windows\System\mewwYYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncHWACh.exeC:\Windows\System\ncHWACh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdkzTXk.exeC:\Windows\System\jdkzTXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOnMLgy.exeC:\Windows\System\FOnMLgy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgpuyrc.exeC:\Windows\System\rgpuyrc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKoanQH.exeC:\Windows\System\EKoanQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBDaqRs.exeC:\Windows\System\qBDaqRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRDcpRT.exeC:\Windows\System\eRDcpRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKpgAAK.exeC:\Windows\System\sKpgAAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNfHRzF.exeC:\Windows\System\yNfHRzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjnaVgb.exeC:\Windows\System\tjnaVgb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdfMrNR.exeC:\Windows\System\qdfMrNR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEcYwRj.exeC:\Windows\System\QEcYwRj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKacDsv.exeC:\Windows\System\rKacDsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CzvyNrK.exeC:\Windows\System\CzvyNrK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SukCRFB.exeC:\Windows\System\SukCRFB.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53b20fad6ecf54024dafb4936125ce83b
SHA178df85b573c8f457653cf85c128ae61399d54dc4
SHA256edf35edb7109687703f5467f5fe3ccae4915868f7140aacbfe36e976638a2da2
SHA512a47bdd3fd6eda403cfce15d09693c47b85957428c4eb4c216236378315669c0e245a103763b7f5feb4647a96c79272805fd09232a7f3ee1abda85992d1a50917
-
Filesize
5.2MB
MD53161a5c374d63898742c50d57ddea230
SHA1b635db692182f414bd47640b3b088fa0863cd32e
SHA25621186e6941d0d20abc26a6583ce21ad0fe9ff9dc05d1da18a30d3d9fbe566f43
SHA512cc760f13e8b011fed3ee8b6e47aa5c1446c2c304df432a869f52ac269a8d8c1456ecd2f6759baf8f5dcdda4ec298f48d10b9e15a50e15b1589ee740bfa8fabbc
-
Filesize
5.2MB
MD50affd46f726d50bfdb59e64dab7024cd
SHA18f9a8aa9ecf32f80fe41714f3e77a8d6aa8e48b0
SHA2568f1928bdd746489e9e31e9f6433929fd935228436fe9d8f02ee0385300d38476
SHA5124ad0cda5c6c36257d62272fad1230fa73d5d32d9b2df0203d2abbadbeeb769610bb877f7ffa711844e279ab78869df808b6bff3a4d19940d7a67086fd0253218
-
Filesize
5.2MB
MD5bfa01a059adcc172cd21f1e5efabdd40
SHA19b24cf4fb4ef6a17d00b5302adcd95dbb60c2be6
SHA2563a19e3ddcf4f982f4d838fcb7ebff95323d57f9523e861ecb1adc5a2fb1e2198
SHA512fd536579e57e134b91a2ad4a2b91bf668a15ff9f39e00e9d68f2a3d99b687395b1914541cb9e5aafac7f0fbe8df082ac52f3bc3b4876f5e7c85f74505724159b
-
Filesize
5.2MB
MD513bdd89b6a118d62c9c2c104428f2984
SHA1bc2a7d86bdf90c31603b42254cfea38bdd317605
SHA256e7df3354da5fff81ada875d1cf1ff0831de19a82f7912b6dd9b63ec87fab0bd5
SHA5123003e237a647a3216929c47e7f3b0a115f5a27f3cde1cef788d918de4d0a7f4c1594eca68412fc3b1cc2d99b57fb9159d9038d790c33cb3246be3111110d7b05
-
Filesize
5.2MB
MD5370b36652d16d72883c357d6207c8148
SHA1e6f6655b39e54b9243ab9b6607b8f818e387580a
SHA256c7e386c4b55255cadd2493039a9cc63ad4d9b778414807a8e3854283713a72f3
SHA512cb9bfed7747439f5313c93fd8de9377b9363b043476cb1a11882fb6aa7f9bb260a84e47bf56557dcfe4f766101788740f37cec942e24a80ed19521cb07b36778
-
Filesize
5.2MB
MD5f44118d24c4ad488a3241895bf82e4ed
SHA17a5d21a8d86c397f4d8888e7aa5a61193045610a
SHA256d3f47f6bc1c4a02d2e4529f0ed51fc0c98d90fa59c53859f5b2bf820f4d16aca
SHA512a658002f485bb3cbfe55214bfb93f405da2d51b9736b2248c6b6aefa52574d6463c15072de6e43dacbb6cd8d6f64bd33923a7e2d34b0dc8b9a2ed3caa405ad2f
-
Filesize
5.2MB
MD5b31a1992a01ae612924ad18c020ad526
SHA1062bcf3efbc015df2d26026a91280e991833afc9
SHA25661e992e48a6c13a4efd93650f91aff01d34258007e95236b88c38b4f20acb589
SHA5128c06db005a9e8044ee1a1b7f558b778d557218d7a383f65881dfd6c1a7b84ce4e954200119665e6ce1411b93fb1a341514d1b0cfdbdd55e0d68b5dcf414b5a40
-
Filesize
5.2MB
MD57e899ab2116af5d3fb1e6dc1c5785e2a
SHA1700cfdd321841cff8384e8ab770860258b339eaf
SHA2564672383562121c1b425f85284db1cf74d7320944daf50343639668a09a8e8dc9
SHA512eeaf53ff8aba156d50fd3cef8a6d610b7a8e7ebeac361e81e1219b8431fe6b69c98f23c8a411da9a969e802c807f1d01cfc87abcdb05b71447d746881fe9344f
-
Filesize
5.2MB
MD5bfd45199d24aed0d2e3ac3f755f3a3cd
SHA11c0ed3e68a2fa51b25c63f4d61900039bc8da9b1
SHA25672c72202ab5e842cc7f6b93b676bf59fff7257e1544d7aa620fb2aa36566cee3
SHA5127ce20db8881aca019138665530717f10dc949c04c8e8c34f1f89bca64b472ddd08a1f67cce6b7464b32ec08b86b08f2950867f2d30b5b2581f618a78b1f71746
-
Filesize
5.2MB
MD5c935e2bdf32fa45f609539f51f7d1c23
SHA1d306dafd4766c2eaea50bd5414aaa30b561cbda8
SHA2565bc88b89781882a58f10aa3d0774bf010e79c94de2133d1420b8cfb07016dbf6
SHA5124c2be181fe9b0a23ac9636d08c0e7362ee95c6788def5d34f92c31329c50c3f8afd2e1cf8765dea441dcf7f27a0a66381cc706ca874924385365cf1f5ab1d3c4
-
Filesize
5.2MB
MD514ee42bdc9b6ba197995a940bd5e07f7
SHA12c1c7c022ceb9c47f6ae9fbacf19986d549489a4
SHA256ebef89b091abbbc852334cfcfca214022a980bba05c5d22d6e888030fb42c340
SHA51269ecad0d7f819c7eab161fd68135a521f674356baccc401fdaf067929e434110d486b3ea9cdc57ffa211956d73c50b9eca88ed12dfc259c8c2260852fdd522ec
-
Filesize
5.2MB
MD5afb46480879434f7f1062c4070127ee4
SHA17d105c6b6f1dcb874ba1918e95bb3709420eba40
SHA256fbb79f72eb88212565173835e638135f7336a34a06ab07a0e732d1c410343971
SHA51264b131763b171a858422599a01ffc4afa39cef4c8ccd9a3448755ff54cee0b48b325281fc426d31978d1efbe262022e4ddd49ff88844226e2fb6a599afe3a804
-
Filesize
5.2MB
MD5e03ff5bd2d8cfd37ca4903ad79e9d210
SHA1f55c209dc34d3851ea1e482ef03fccd6694e8d0d
SHA256efc2ee72b2d8dbd29c916e4907cbb83a4bbb2637bc0964299c0354bfdf16de79
SHA5120240e84fa5641369a852a690272efcd0881c82be0b88d81172edd0aff2ac2016e2d599b05a314028194d6c9730c8b6f2a148bb7f9c03bd766a652fc5558c8684
-
Filesize
5.2MB
MD5514e1344001cc29985720d1e76040e3e
SHA14e7171d8cbf201236d57da675d19ac07321a502d
SHA2568ce0ce538614f0d95eba3076c66ab1a8accd5a7aa5ea0e722d0595d7f879d9c8
SHA51267bc2d4cbed751b9fba1f910b7b5de421ecd437871d7b00146a7383f6eef07f4f2689f7676a7d91279dff2f54ce1ab50b6ef638f5363354f52c75743d924ea41
-
Filesize
5.2MB
MD5bcbe91cd7c53380d2fe62db74af21127
SHA1235ba89a76363300cb1c77ae6cf058c108017d71
SHA25638caadc3b2a4b2385318868451489ab402efb3f57f3569a5c471f08fae8ac019
SHA512d634810cd32792504dafb30ef980313b6ae6bdce4f857239af4bf1f8858c04224057b69d469e3c5ece46da2ba814aef682e61aceec9593b3d157bf7e8d8d54aa
-
Filesize
5.2MB
MD51c562382d2aea213ec6fea39516dd771
SHA1457351979cb45e8da54b737a4456ab58bf5ac77b
SHA256b75562fe1516d2964618688c2dddd0de9e8e1d37423fc3590ed87e0a23fad995
SHA51257f0a0e169d442ed2fe80040de42e32028134f0b7c00260625167e367ae508c619b9c3c96b18d9544b48d61ee71161d6f9c2a835598d5540a64f6d7d3e3eb994
-
Filesize
5.2MB
MD53cbc696dc86e700a04a01cdc543deef9
SHA152930b06f68bdfd55e46f8860cdeeb910f62741e
SHA256f55df488d0bd604b085fff7ab684814a6aa7359a68f6d1a808e72a45321cb963
SHA512b51e19cc7a2119fb2257c5dba4c347cd124a61cb57a7f026f159a1485a7b8296c473eeb2d1a51025b8ea6a42f1a055605b124b2028c0c1de9c3bab02759ac3d9
-
Filesize
5.2MB
MD503f6cd212ec9d84bec6742620d2b3405
SHA1acf69d4a01acb6f4ad4d2e57c80507c51917482e
SHA256dd05fcd0027fbfab36a9a1daca8cd19e47f444ae7a071d3eb18f15635cdce45d
SHA5124565950ff42abfb458069d71581936008b116acd3fab0b5d6dc261fbf72ddb6dea0aa56c35f241920387dbefee16ae89425b9f7329d7656d5833f3275573c295
-
Filesize
5.2MB
MD564a78413f7341329a0958f0097428dd1
SHA1b0ab14d24912c60549647f94583ce0e9cabddc14
SHA2560b233420a014542d397268b8dff0d12f018d7f94c7aa61435cf29ecdf1d78125
SHA51216e22926dcc40625f6866aa10abd45cc7f7f0d6c8c80831ba3df9fa4ae314027dd76336bfba4eba71f8fa699cb90d0dec1e0c0db08d5e6e0bd28e4870f47eb34
-
Filesize
5.2MB
MD50ddbb10eb75a4638bba4916456aa8fa4
SHA1a6a3e9272501d8734e5e33bf0ba91db0a2a7ae88
SHA2569ffb7bfd178b508367e06e179f906b96f07bcf31e88c0ef0a555a88c5f8537b8
SHA51257f9af821b918166bddb77085d7d81f3aeb69880a6d79446dcdd5c7988aa60f217ba5db100049f318e20df4ebcefca6befde17ebde233c674880f837674240b2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB