Overview

overview

10

Static

static

10

2024-05-23...ke.exe

windows7-x64

10

2024-05-23...ke.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_83a9c9d4323cc1c8fbbdd073f5751e11_cobalt-strike_cobaltstrike.exe

  • Size

    5.2MB

  • MD5

    83a9c9d4323cc1c8fbbdd073f5751e11

  • SHA1

    82a8c93bc1cf2e6acff2cfb8d0a7619eb0242359

  • SHA256

    b68ded42b14484af617bc803500676f36f22c1cdebacb4f22ac3dbf20fc4a620

  • SHA512

    e816fc6919482772321e2f31305070bd47deab4dde0a15dbce26700dc090f34d0a1db136fea853fb18ec6c21bca0853643cc1e208cc674dcfdb6c5a6aaefe750

  • SSDEEP

    98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxEU/:53EnsxxDt73DdKrwapwbL/

Score
10/10
cobaltstrikexmrig0backdoorminertrojanupx

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 3 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 3 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • UPX dump on OEP (original entry point) 11 IoCs
  • XMRig Miner payload 8 IoCs
    miner
  • Loads dropped DLL 24 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_83a9c9d4323cc1c8fbbdd073f5751e11_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_83a9c9d4323cc1c8fbbdd073f5751e11_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:3532

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll
    Filesize

    5.5MB

    MD5

    7546f005fab490646a943fe57cd039b5

    SHA1

    3d53fa45b4546ebd9aed3652eb2701e4fbdce7c1

    SHA256

    9f16db5fb44a17fa76e50aa467c18151ac12a81275ab65fca0997a64347a03ac

    SHA512

    84597dd8abe82e2698beaaea7ad4d96b04a579ff935e636e6affa55e3fc390b73d5678a41882b1260f276d174983a52104d6916a552933e7d30c3e2146c037b9

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
    Filesize

    5.5MB

    MD5

    c566c3cc445070b5a80189a5f25c1a4b

    SHA1

    cba6a05978074b98b05aec1709bc30c00fe79ca5

    SHA256

    04fe1ef9609fcc38ce8d1107bb3428a080a79b7c4312742e74e2fb13ccee5e26

    SHA512

    eb4fcf948a2289dbdc9791c186bb48d07e120a4ed05a4be6b5630626cdf553e14f8c167a73569e3087939ac126875a60a75784c588068b57b7290792277be58e

    Download Submit
  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
    Filesize

    5.4MB

    MD5

    d6dd9663f066622dcb44608c505b0dbb

    SHA1

    5abacf04310560b464a3c16f628385740c928f79

    SHA256

    25affb60ddfbef344f54f7316478e3c9ea8378671c414112bd058e949171ffbb

    SHA512

    6c43f3f92c3622e6b836974a1124118d37d6c17690a5bb0d2812fd17b2c64df24fd23aaecd1534b583db083c3f9c23d2366d34ba194a78ecb96cffe16452e321

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
    Filesize

    330B

    MD5

    1d37423f09a1d6926a3e0ec7c1804988

    SHA1

    88ba4d79d9308dc587ce3853172c8ddb462c901f

    SHA256

    30a19a4c5c51c49c33a71b124805457f7747fffb0604a2d50ace3f66d9038cbe

    SHA512

    f4ba29070ff3fb561df3ebf8a6f531213c92d67e7e855fbc6dad2509944abc3a646af48f20d86ddd4cb553fabb5d361469505e32e5e7079a66397e5c78723a16

    Download Submit
  • memory/3532-3743-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-1642-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-2212-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-2739-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-0-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-4534-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-4535-0x0000000000060000-0x0000000000062000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3532-4540-0x00000000001F0000-0x0000000000200000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3532-4542-0x0000000005870000-0x0000000005871000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3532-4541-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-4543-0x0000000000401000-0x00000000010B5000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-646-0x0000000000400000-0x00000000010B6000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/3532-1-0x00000000001E0000-0x00000000001F0000-memory.dmp
    Filesize

    64KB

    Download