Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23/05/2024, 17:57
General
-
Target
2024-05-23_28e643087db47cd16c8de76bd02957f5_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
28e643087db47cd16c8de76bd02957f5
-
SHA1
94b94936c7e6b867f69179e1424099b3dc61660d
-
SHA256
87b06fcb599928c18ec9a51391ff20744d2a9cdeb1aa51f3dca1c67d0ac32e03
-
SHA512
032bc84a7be46243b014740b9e0a5d15a202ac9f54daeb62426e4dae2160a431df17ed4d2f7cd943894a17dcea202029b255c76bc8cfb058a35c60c07a72e295
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_28e643087db47cd16c8de76bd02957f5_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_28e643087db47cd16c8de76bd02957f5_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jpLjcLp.exeC:\Windows\System\jpLjcLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONndBvN.exeC:\Windows\System\ONndBvN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\porKgZa.exeC:\Windows\System\porKgZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzEIozu.exeC:\Windows\System\OzEIozu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSbJpyk.exeC:\Windows\System\tSbJpyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMNWeIT.exeC:\Windows\System\oMNWeIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSeFsvH.exeC:\Windows\System\SSeFsvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ALEZJnw.exeC:\Windows\System\ALEZJnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYJBaVn.exeC:\Windows\System\vYJBaVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlryRku.exeC:\Windows\System\YlryRku.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcIaILk.exeC:\Windows\System\OcIaILk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqLwacH.exeC:\Windows\System\VqLwacH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtUkRtP.exeC:\Windows\System\YtUkRtP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bljDeQo.exeC:\Windows\System\bljDeQo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMTfqhV.exeC:\Windows\System\TMTfqhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PkAXEdM.exeC:\Windows\System\PkAXEdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtKodEw.exeC:\Windows\System\RtKodEw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JiAIeJp.exeC:\Windows\System\JiAIeJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlffwcK.exeC:\Windows\System\xlffwcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bOxTNEk.exeC:\Windows\System\bOxTNEk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJQaspf.exeC:\Windows\System\xJQaspf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD519445d1604958f4425ac87014fb45d0b
SHA14a8a99bf605dc79da641f0fe91f169df54b14ab9
SHA256ab7fd401c1ef3bbf2e53ad06c7c6b9c30be3f7e688dca16e01c32b64e1b96d29
SHA51266600eca3fcef45c214188536ed0e5354819d925476bf5b23641738b102169b6366dd8e237d7bbbb2a43129015f3ec80860200da08cdeb8f3f9921d5f65a19a7
-
Filesize
5.2MB
MD56623901f21a8161cd1c3534a1215bc2e
SHA1dee2e5560e9896f326ee8ad9b18912ce0fb2a34e
SHA25692c34c1c0684990a0b9f2878beea1bbb2f2439c71d50f41a9ab793478ac67a35
SHA51214b170f68e4a462a75546bd5d5c5073fa35c0dcb87dfca3c0cd89f4ad2e670bb5eabc3e60a0f77155759d2b917c7d5629f93710054329d126ae9566f2bf7b591
-
Filesize
5.2MB
MD5e8607d494f3163e74b043284bb16d80a
SHA107ce3601e41ba51459ff91950b37c9e45f7d6b56
SHA256dddd48f3bfaae733491f396a4ca43a6a637131a7f1d8a827ac99f055049ea840
SHA512374387ce09e4c8145fc8e32203e8cce00f976af6eb1ed433d5d7d905f7044149f0a41fe50987f9d7d197e34dd8ac60d6c9ee3e28d344fab156524ebe463cd6d3
-
Filesize
5.2MB
MD5c9e24dd7e91fa9ccc51a04aa52292c4f
SHA1f96690ff2763f0cd3de5a3b7a54a47f31466df7f
SHA25695ba8762bdc104f6c47f3d113291efb81e5b5bbb80a84fc6fd215d7d18c0dbd6
SHA5121d7fa4e726f7f4d00f40922ed0d79c35941c432280c56bffebdc5c0a09cb3f8b49aad729230b0276e17d98d963a192e1650b7e567ee926ec31d9418f7d2f7848
-
Filesize
5.2MB
MD54d4eda07f896272d4f3ea3585480c3cd
SHA1e68d58f20d9354376efcbed22a455a56fb487238
SHA256b1bbf77187b1a2e6476ca2068a0dc2198875e279936bd6efe8fdeb72682a6bc8
SHA51273961b3bd8200aeba2c84d37e512bb4f6a417762b22752ed0722f7a98efe5b697caca1207ff46c32953aa1455a7b162a309dbe2ddfbb89a065f29bff14ace503
-
Filesize
5.2MB
MD543844b5c23f2ef4ab897262d30a66558
SHA152cc8efd7c7e89011e30e444e710d8601aa80928
SHA256dc756d5a8af09767475ce2aa53f65ee814daae77073e2b1f23dd4d8684e014b5
SHA5125a28185c86b90f28714deeb9eefd64fc728f91547aeb1e33deb201fe549a5011de7b82c34dfd81c99ca96a34c1729419d4de0c87de7e9c75ce6c178a7962afad
-
Filesize
5.2MB
MD5f74644400157a409cc7a4811ebb5bac2
SHA16332a7c4981db8a53bc7142737618047a41c7fc9
SHA256b7dc0f3ab16273715cb59d22763716e48450f18636bdff9d8afe081a39633bec
SHA512b3a665bc6915d3e6369e17e07a2e520493a643f6132e8188b7f702ceacef878a8a6738cfcfe4fc88ef79f6359649d6fd0cbee507b221ea145bc698a646fa6aab
-
Filesize
5.2MB
MD598f5ffcbf627d6039634a41adf3124ac
SHA1a40ddf6ff096fcfe49a8a89e2d5b43e3ab1a5f62
SHA256f9009acdafd58c9c5fcf92d6aec802cc65f17481836d15b8bae4117cac7251c0
SHA512ebb434dddd42a542b72f19dbe2884acb8eb8884e22022a20d7b54570290d7bdb230171351cea86938339f5776dc5a879b071823de87f103554b81536aea13225
-
Filesize
5.2MB
MD523adca9b8323dabbecd00e0be63f227b
SHA1971997456104b15f2a27d3517e26a32d25c3e43e
SHA256b90459cdd7413cc574970e5f76ea2d2cc4e565b68e59025ddcf835dbc1af2faf
SHA5124352c8d27d7f39fec718f8ba60bbf4c09e4f71143701c4c85fa80b33e8a89d562f5772fab9eaa21a1459236044d43543fa83653622b381a0c107e444788328ea
-
Filesize
5.2MB
MD59c8b6fc8523a852c786d0415d84425ae
SHA1feb89c703405394567f05863fac2b42756497f2c
SHA256848cd38f457c31a478af6fc62a1624394c65cb7766a76a041836912d92154b54
SHA5121c23e12e93f447730f7caf6b6f512f14a83e1d1ddc7dbff4577d49e3e403e26ab4901254698a7146077ac41bd25c9a8252e3da3553dd1b6cdc5906955b7e77d4
-
Filesize
5.2MB
MD53d3f46ebaceb0a8674e982b223dd89e1
SHA181dc42f67acf779b2b090e875caa1efc8c92706d
SHA256d8e8b95f74cbfc90c759cb1e9f64226697d39adf9d357692c83e3cb63822709c
SHA512bdff5f034c09e9195b1945e238d66c3e6254de4066a9398fe8b9090a41615fb77ccda143de350fb52726360a2cc49e22a377766294d983964f2771c07c642a61
-
Filesize
5.2MB
MD5048959afd8fe7d642eb4c3201cd28ff8
SHA19bd350641dcf9fdf49f7971e49bc892db755cb10
SHA2569d6dd8118666c081e8c5a289d4210e474232aecd54a8ff6667a8d5afe7b0e314
SHA512bb8d33a1f5e5a2589f11fa2703666773215712be88b536b7f1b752a6dff489f0b92f97ef9738f20ce41b292a4aaabe8b15ceb5084b9c5d71a165e7439f48837d
-
Filesize
5.2MB
MD51d7f514bea517ef69ae5c485910750f9
SHA14434509cf6cfd321417d711eaf96b6fa24eaaef1
SHA2562457b472d68b52171aafca4820ba2ef60f0f2e12f6cbbd4301b2e6a2cebf5987
SHA512c0d82f9726b232b13c5ce0ec9cf56d50bfe3c912a8e713664e452dca8d06e3aaa8f5da57adf5a6ba7ee1ba550927049d261ad4df40c20171bc070cc016f59912
-
Filesize
5.2MB
MD527b3b532f7688a4702d0590d5fff872e
SHA13763e1227b09b0d32543558b7ffe3da540642c1c
SHA2566f53f1c2943f35565ce6f8caf1618b84ce21ff5635acb1e5dfca41e00be0500f
SHA512096fe0066bb0d09b00230e3569cc752cccb9615efed5e3bc745d327f3af09ae1aab88563b757b179ccf89fa6e68046b2e2d74e7c278b52e4baf9b75ba88c22f6
-
Filesize
5.2MB
MD5d5eebda05445005cd5f99e68b2ae33db
SHA1c59a4044c970fb3bf4bc48154514ddfc7675c560
SHA256bc6f637b0458277c98d5fb32eb98b8609f391a163a40b53826ab40e7093c53a8
SHA512491034c5a4c24e642e6f61b6f9ddb8b0a47d874e467d10a45461bf4e1ec2b58af508c7ac2e7eedec8573cdcfe3b19cc822019ad5e190fd0de0f885a49c6f8a73
-
Filesize
5.2MB
MD51bef2e3e6d1dbaa0a5dbc25826f77608
SHA194bf2b5f8ba1c25b9189dd3e2ea8504f0cdd040e
SHA2569f45b5089850f31d7d7d19b898acbb7742192996bd22021312eb99dcb33f3424
SHA5122a44a83dc04d60674f29da65b033178ad40b5346040b0d75cd8b36a695693989dbf0c3c698e28b27022a90262a9629edb79b8fa32136990c84477afef39d6a86
-
Filesize
5.2MB
MD563ac6b2bc6cdfff9c36ba4a8c1dbe0f3
SHA16709c1758a546e13887cce74f2a6fbe8fb5d3299
SHA256dade9bb6ebd59521f63a0045e02f7ffdf773a48c76a9db921d46dc4229d0b9b8
SHA51249ee536daace42e381e09f92b916615b0dc2639f522af96de10cd63b6f1014cbc6794b9f0f45f00155b43ae65bd85968703ac723310b8a51a61506e721c177e3
-
Filesize
5.2MB
MD521a9b2d1b47a9bca21e535c11728694e
SHA15c7a0e64a565b917f4f8565e67d50cc90c8469ad
SHA2569dbc8a92159df6e73ae177edf27c303fb4244e0e5b337b3226b7db59d1f2807a
SHA51216489a2627645a241fe2ba121a3a55f16efa237323d7ae91dff54c7f9612fbaf50b54d9c680de9c329ac1a7968a9912c7affe38a76efe030f71599d858d6aa1e
-
Filesize
5.2MB
MD52dbb9bbf3d6c432d858e48f5daa00db3
SHA110fb6471b0c70664032282e7620f276bb9a72336
SHA256c6e4444a0ecffde6d65cce5cb81c076b790403bf8041c7104e791a8d4c882133
SHA5120f691d080211fba88f048077ff5446c6e3eed8586a629b13f0b4a15f69361495254941366b7d7d0ed46312e6941eaa6c21f5821e539e615c27e6957fd73c3f31
-
Filesize
5.2MB
MD5cbc64f0860d00cdd75db58a83afaf9bf
SHA122b0e9d8c8a9507391af3309ceb5e36c55e409b8
SHA256fbbb69b2ab9bb6d920cb37868f6b29fc3a37f179faaf7e47e4cd9dce14a1a76d
SHA512e968b67707900071d2e20fc07ac9af8bb762d6b5cdd9467898552b8b5b278294956062d2a3fc341a5e5d84305c06bbb66514fc41c0dc3eb12d9c6ad4c9c1989d
-
Filesize
5.2MB
MD5f975c0fe7010264c64abf1ea6ad954b4
SHA187f0148d32256f5b27146c2f9f615215730f81da
SHA25684819e371625641be2b9b3b77ce879e15402ecf7c6bbfb6edca45385f69a8180
SHA5129e2401edc26bf58cdcbf9bd5db07f473ef7794822584600e1a3ee0e829beff1fb7230a62ae1712b45764b0129091d7b313ad93ea71dbb20411e68035f447a5a1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB