Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 14:45
General
-
Target
2024-05-23_007ee70834c2ad0a8085c7d9acdf8747_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
007ee70834c2ad0a8085c7d9acdf8747
-
SHA1
8da4d88529f2f717b8e53ec68e9b4a107221914f
-
SHA256
6ee8be4283e152ec0f971b540abe35dfd47feb9fc8baecd6d3a29d7afef49bb7
-
SHA512
fedae27262035593132576f0700da3c4eb2017afd26708bfcdbb272ecc4f7734238eba63160d26364b303478f8dae651f6cf53b189c5a418db8d492f442ec975
-
SSDEEP
49152:ROdWCCi7/ray56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibh56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_007ee70834c2ad0a8085c7d9acdf8747_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_007ee70834c2ad0a8085c7d9acdf8747_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dOaVVXk.exeC:\Windows\System\dOaVVXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBberBc.exeC:\Windows\System\dBberBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\paxPFhF.exeC:\Windows\System\paxPFhF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzGNuHy.exeC:\Windows\System\fzGNuHy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iozDjOy.exeC:\Windows\System\iozDjOy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBPoQDd.exeC:\Windows\System\FBPoQDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ocmkgfn.exeC:\Windows\System\Ocmkgfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULPCAzF.exeC:\Windows\System\ULPCAzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZjPHpW.exeC:\Windows\System\AZjPHpW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hdLrMHg.exeC:\Windows\System\hdLrMHg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jWuZXxL.exeC:\Windows\System\jWuZXxL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgRHpTU.exeC:\Windows\System\NgRHpTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mOPQVtG.exeC:\Windows\System\mOPQVtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qayzRPF.exeC:\Windows\System\qayzRPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJpZwNq.exeC:\Windows\System\FJpZwNq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RgWFtKF.exeC:\Windows\System\RgWFtKF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udrcOUr.exeC:\Windows\System\udrcOUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFludyH.exeC:\Windows\System\gFludyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpXMgtM.exeC:\Windows\System\fpXMgtM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJTTjqk.exeC:\Windows\System\GJTTjqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLpzsZY.exeC:\Windows\System\tLpzsZY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a3872da49eeb8f4c3db3fb4a7ffcbf7d
SHA1a8954653feb9971c962e463d12c86a485f67131a
SHA256f2618f494f3382fe2da00ea0c7cdc22cb5cb9c151698710c3ee349539d055296
SHA512cee5798abab7e82ecdf9e4ef9b264ae2af4087b352017e6b203c11d18aac03263b414baf03b9fa4cea9ee6b70a041700641d4427f89315ec4fddd4a8b121ac13
-
Filesize
5.2MB
MD5dd6b49a8b5c5b773e4d90aa08e56521c
SHA16252a1e8ead3beda336f2c29fd16883f80c83ba8
SHA256cfd3111ad7bb37a37ea1c63b55dcbf168feb71d8d763f4e99a00b7d51792991e
SHA5125c4c448d9bb33dc39438bba98bc6cbce6a37d6adc80c25173b2744c52a788adf5082487b86addaaf6c9978666cd4ed8c6bcc37438fb2c1c1a46b5978ecfbce62
-
Filesize
5.2MB
MD57767a4ee091839adde70584e1aa2e411
SHA167f4c4117b94feb5ade1d5e600a477dd90055e49
SHA2560763c0319281d657a2c1cde86a7c11531a30f88fbdfd5a68e250b09626c38741
SHA5124deea21dd485c5f10688c6ce3dfc2559215944e9cbada6fcc9be53d98867bf130ab9fff65b07d0cd65692d39ba9f19e4b2bc79d804a8260802546720a4d72108
-
Filesize
5.2MB
MD53402c70aee2a0f680d3692611b8b53fd
SHA10b46a30f64cfc4823b94b6d7d1499e82a5bb89a9
SHA256a8eacd4004e8ad7232b0ba9229204df889dca66e47947f51c02c39c9b53f63c6
SHA512530bbc5b37773f58a91e60b7df09233692d0cb245fc86998521ab062ead01abe8185c500dc707128f2f18a073a0d7d7c9e36320860f34d939697bbb83994c526
-
Filesize
5.2MB
MD5d20e81a8531793f789dde7aee6970f3a
SHA19aa3cec3e6d2232598b5445e20f973df36dff3d9
SHA2564b3a378748cfee3f40b8444dee4709f433be18b3dd8a0ed631d0b70fa44cc228
SHA512553ff161d13589daf17e03954383cb4b48c6f6c56231deeb3d09eb1b454d9b70fa7810fa4fb18f427eda160f7c2f2f363f5b7e08a49192c81f21423b518db713
-
Filesize
5.2MB
MD574d63d699dac2dfee955ae88f994265a
SHA19365bd52cacab08ea6ac9fbf360f7bc1cd22e398
SHA2563d0c7dc55351a825b5dc13e92e79ed0cba0523f61f90fa24ba90c62f1bc6941a
SHA512f54277d5cb36851e568ede9f19cd9a5691e6ee799a48db53d8a6519db09c751e868266c14ba3bd311e2c1eb69a0d1151d52e55e38331e47f5d60dab9c4128368
-
Filesize
5.2MB
MD5ff36529f103f96ab50d1f030ffe2e8f2
SHA10838acf0097cced786b18fa474e6066dcda4ec9d
SHA25621d09c2924c43dfaaaa4fe40e5c4f492d49f228e8e4d0747ab4e44f45ca18800
SHA512c094b480cac2e5a728eea4c9f296929b5b80088ca838f7a21f5c13f4f720ebb75dc6253d3cbdc353597c426e62090431cf0b1e803e48b7e585a750570a05ac6d
-
Filesize
5.2MB
MD5954ca189f306bb80850792a3d3b02562
SHA1325557113393fdbf62e22914e9cf7d7a3133b717
SHA256b75458533eae6268074da66492917d943b9cca16f5611a6e293fff3da18953b0
SHA512fb51fae7c6caa13913deae08efdfdd611edac603df54f24a19ef7022da1b4e7427d77679d2cc994ca7f073a873573076f07709c30093f9a7627ab72062eb88b3
-
Filesize
5.2MB
MD57ed7afc83ed892cd41575e4a4a9a2e84
SHA1eb80412725a6222c3803f20c0ecdbc5936a5944b
SHA25671b1b2ed4a06b6bbb8b8b4fa80887277d0c111e9fc24a448822b4fc1f4a15cba
SHA5124d2743ecd7e4619b0d932dc0290c0d1f65146b4f9658322e1e2d1a1f7fadf1c05970aa7bbb08c20bf98680c83e89f1ae61bf3e856b6388c8113d583f510e28b4
-
Filesize
5.2MB
MD554cd9f82598defcc6f7cdf14d9a124c8
SHA1b70018011c0d0d1568ef9d49f20a40e8c2dec619
SHA256b209bfeaf00eb709b7b1ab7f33af97b6efd0fca303b41674d1a696bcfc271bdb
SHA5124b2eaa8ca7f7a3aacc586d0b9855b57be8c6d2fe1740e1866ccd8ddad37f0a174ccb6d73d34b435dbb4788deef1d016f172fa4ecc5ba740d59d27dfb3a925417
-
Filesize
5.2MB
MD5f7dea2a93669581e1b5d9235980f76d7
SHA1453b4fd151527d925cc9f3b300184f621b446864
SHA25632e854389170e8aec5cbcac9a83549b8b73327239666b34ca7685bf65c1350f8
SHA5124abf72441c9f674f3daf762f7cfe9cda500968e0cdb03d3cd2998020d0f2c42caa800afd7c8f72e8ad5472255fa57b0e47ad5242131bfc36da5ccd88dd5bab47
-
Filesize
5.2MB
MD5770de14839a458f82ce1f1b9e3190411
SHA1310ca44d1dca1c945584a2afdee690b9e5d9604c
SHA256308a1fbd9470d1132725664556c88a31b3599a54b55c1dcf0c705da2604360d8
SHA5121cb9128736f14dbef756c4b3de79aa4777d21b1bbaa4c4add7bf756cf2610aa7c7d4dca6cb5127fb79ca61eb9cea2511025e8ea65a0aba03831d69e165ace7a4
-
Filesize
5.2MB
MD5f5497658bfd8a7458c75aa4d72886d42
SHA1ce5c48a0ae292f055ab93c12c53b3930e4bf024c
SHA256a0cd238415e20a4a35a5791fd5262290242f5c2d2f088ba7574c99c8ec39232c
SHA51202b2fa116fe84a6c8b1478b180b83f1c06e9f3b95bb6a9d0d52835be0d74da267633ac8513d59ac11cc260851b3f5569c5e03c281e61b73b14e17348c7e81475
-
Filesize
5.2MB
MD54c7a746568f8b0f3f0ead8b460e382b7
SHA1a8b2a75b9b1f773af286cfb0a52cd4f836a37909
SHA25626ab71bfdde7a78bd26d3817104297b2f34102d2e9d05ff88205dc3b5702ef62
SHA5129873d8937a4fa428e7090557e19b681c015c369816aadaf686b2a8779cf61bbf1b6233d29979633888396e464be4244386f66fc96f9ede9016f59c4d81f39dc1
-
Filesize
5.2MB
MD5f87d9aa9b82c368fbf3a18bb46b104dc
SHA178d6c4a91e02c45a31d160abb1a09ca3d7d4941c
SHA256078238d031ee4a7bd56ebb2c7d5d98d1b1a5a99df1e5af2619539f9194952e3d
SHA5121024ae15b017ef211fd2e9b8dcf87defeb3490601998934e8c95ebb412b476446a039ad0787efe9253ec8c54c85d6536ac870a9133bd0b88819c5ccc945d6834
-
Filesize
5.2MB
MD5f87adbfea9867c96adcc9616654df9d7
SHA1c96381bc170cb86442f210e1c42c46cc399ece3f
SHA2564736b6a4f6b875f6c73d1e39febbcb0c9784a7fad64f12b921b47467e89a5458
SHA5126533244db267c4a3b8598c30d38b1972e1d2010a3ea1e49d807d59fc57d7a3e68ad0f162180f839bfa45efd26a5d2b1d43bd140c2142a41b84c902558f3aa0d9
-
Filesize
5.2MB
MD5dd9e971d0b6e6ee4070103223aac0810
SHA15e39d38c18e5817db4a7bf1bae7c92d0b41440b9
SHA25680f97947724c04d0dff8974646ddb5033fb117e8ae7fc326f6ef877856fd51a1
SHA51287796f4716f4b6e649716e892c756ddbd1d6af32eb963313d462c56581d8aa6719cb427e9d133edda02a497a1092a1dc0f4838a91b2539cc25d96dbd31f0ddbe
-
Filesize
5.2MB
MD5c63c3b160c63f6296a185984a36c417a
SHA18daa917425801c1c94c348ab4b0dbeca64cd94f4
SHA2564287cba3ee1b7f7d9871cb48408b00024e4ec770ae454d2f020f1f78abb1a038
SHA512fa0abd1e323cfc208632fe9fed0aa5e9824a72f7200c3cbd11bd82e74cdec914337924cb99b9f6b34ec6ff8d469e6b5a65bf6f08ec99752fafd6ba285c0cec7b
-
Filesize
5.2MB
MD5531ecc1ef8ac47cf6025cf808ac2110b
SHA178db83162b58b2edc0aab458227ad49efaa5beea
SHA2561783db31bbaeab9d975db05cd1a3f98a61a47cf8524c5151e1d0a2c62aafcb9e
SHA512e97c66a55dc2b898316364203cdd2fe926ef3676ac192fe3d8f226125313612e3fe58166bf086d8396b3a1701ce20d617b5e37676795c3c81b931c1c6ba5cbf8
-
Filesize
5.2MB
MD547363a15e81655eb7cca03adb155e2d2
SHA1c3f38c3e106995d482bcd9fb38baa82b9a8918df
SHA256109a241a28f7bce96d785438e58b4b64e5d8f4c62cb078e255426fef41679ae6
SHA51208301a7439432b317616ebbda17e96ebc59f0beb9b9a04c3396091ae626dc756bda44d4632d242478aa8c13981be7117048538e424428db515dcb83f1eae117c
-
Filesize
5.2MB
MD5c448d229c356c3b8dcb69ce23f9027cc
SHA176a2d1121a8867e626b783d567437ff1f7acd281
SHA25667537ca14b206a100907a9ee6cbe16fc1236c982ac16d084d4e03574891bc311
SHA5126f8918109cec5c434263e86cb6095294a435cfe78eccf925b0656c601baa78258deb78bd96d576455f3f9fec333d540fd2c70c3529a795566530fe4aecbf3630
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB