Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
25-05-2024 06:43
General
-
Target
2024-05-25_ae6639dc9d8548a65f76a52bd1f17873_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
ae6639dc9d8548a65f76a52bd1f17873
-
SHA1
1830b00a0369f995a84c72e5dccc319dd490ddb5
-
SHA256
af8d439fc9423a0afd5773e6a716ee8a7ee49c7aa757a75b6b0ff990e6c64d8f
-
SHA512
5adb4a25159cd95fa9c5a4a238991b02f5f5c0d0025f8d56695488fdd1a977da79bd1b158252ad7b6b39683dac294a9f6e4116a033c50fb12faf60c01ecedefc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_ae6639dc9d8548a65f76a52bd1f17873_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_ae6639dc9d8548a65f76a52bd1f17873_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QhyPogQ.exeC:\Windows\System\QhyPogQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nroHNrH.exeC:\Windows\System\nroHNrH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAgrHIF.exeC:\Windows\System\cAgrHIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sxCCQNG.exeC:\Windows\System\sxCCQNG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iqxeTEl.exeC:\Windows\System\iqxeTEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bALeACM.exeC:\Windows\System\bALeACM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgUDJhG.exeC:\Windows\System\GgUDJhG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isyojON.exeC:\Windows\System\isyojON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzTSGur.exeC:\Windows\System\AzTSGur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lRilNvC.exeC:\Windows\System\lRilNvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pLRtmVs.exeC:\Windows\System\pLRtmVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSsLSWa.exeC:\Windows\System\gSsLSWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WlSQKKm.exeC:\Windows\System\WlSQKKm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBJGoeW.exeC:\Windows\System\mBJGoeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlAjosT.exeC:\Windows\System\LlAjosT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aVNqwok.exeC:\Windows\System\aVNqwok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RgvcnOw.exeC:\Windows\System\RgvcnOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\arGzDEM.exeC:\Windows\System\arGzDEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\niNweAP.exeC:\Windows\System\niNweAP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMNMPMc.exeC:\Windows\System\oMNMPMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSDklsB.exeC:\Windows\System\PSDklsB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58ffdded267c5f6ddb3aa38cb3478f463
SHA165310296fdd6f5f02fcc8b612a5c9c22d2c31021
SHA25667ff429a2ab3e988c38bdcbcdfcc04dd64f8235691a252e2fb86a91a37517626
SHA5122d00b9b13f6db64d7cda4f27b01d37aab7d7b8e5bd2c1cc1d6ce8317cf24b470540c5ee9a4e21127f8d014c30fa02dd6fd3c4c526a24fde6ba2fdbb3d3a880cd
-
Filesize
5.2MB
MD583ad73f3104da64c37083a50cfdbae7e
SHA1228bfb5a04f0dee0352e85eae442f45b614e720e
SHA256b7f373d5189dd5c86980190929e68179473df90a0100e63112cc08681c74d26b
SHA512561713bb5bdf24c788fdeec7ddb7cde33ce52667877cc4160db4018b9fe06f7da606e6a9b4b5226929274ab9f70e36d6b29ff93868ba3f89fb9cb4aa41c7b3db
-
Filesize
5.2MB
MD5cfad123f576235d086c43843fbc04655
SHA17533a286fc385bcfcb48c72ee250acf374288548
SHA256d87ac96e133327c93fafdc61c6bc7c284a5f8e0948d574f704269d07a1b92795
SHA512493b5c66901bb31a6bed033ea99c32d9323521bbeb766b5d6110b2348e0ffb34b5f288b221c9c421bc38ec1a9286d03454623bd88bdf4e8c4bdb8a67a9c3966f
-
Filesize
5.2MB
MD541c8d5315d7126bdf2f4138be4a135a6
SHA18bd1fea773d6d74923e33656ea2bf86e9926006a
SHA256ff21be3471fdfebad995843729f5a336346f66421e0b9549cda5782b06d54f50
SHA512e8fa5b0663a456e4c333a280df667cd25cd57605ce5b0090415d7d17083f68766d4cd2f5ef94744f44a0b48a9ac4bf524eae3d11b2c1004ba35ece0d5859a3a7
-
Filesize
5.2MB
MD5953d7da871aeee91e889369c6dd0a3ba
SHA17e8180e11ee928da6722862d0863ef9d32b44545
SHA256dd91a1b930a31b71445d7758e1a63ba7e55a865f6ed67bf21f313845a3bd0cca
SHA512fb2428766c4c520b0f523009a458a8a9fc193be08d6fade512940aa1e4ff010f55d7f6aefe9b2e34c2c5b9355ab5782d00820590c7f3b7be3d575416076b516d
-
Filesize
5.2MB
MD5c2d4b06e9b8d4dc8dc4ad3690f50acf8
SHA1b494930a2d2dad125b7500d43088e8ba010a51f2
SHA256e5d23ca735614bea74919d9ddcfdb75b1c2638a55ba524710d818cede8d7e26e
SHA51256c2455b2fcf4f33d43ff6cd08a475c2af0ead6d512ebaba7758a00565152b2d97423828c33207cd28794a30f6ec06893dc9f039d7bdbaa1f7d2ee19385e08c5
-
Filesize
5.2MB
MD53a49a81d1473f778fcb7c6eb97e46999
SHA118af945a22bf217e4e0d79bb7de2eb912b59bac7
SHA256110e506739f6d73120ac49920e9828d8d4f6666a3b31141f7a3d35126c0e26b9
SHA5125e458389a8658db05d8f6f9e759d31f63067e42d3ad7cfbabf6bf0498fd1f8a9dd555c0f5a0b4f5eaf11b54ff6d877e11fa8d7e82e15a69b3f61617e9fd013fa
-
Filesize
5.2MB
MD5120622143d8054161809e037cf142fae
SHA1c2b1f5d1f9ec57452a67944bf08ee3f3c223f44d
SHA256e36dadc8c02c2aed0eaa0509a1a501f749848e6bab3af42fa23340534fc59f49
SHA5120740ca7c2d61826a3f31ef6dbd25ddafb4f859b9879b8e34fb43fc0bed6a3dc9867b1606083e284375889338d03d5262446ad0f1d6f78f7775b8af66f41b3042
-
Filesize
5.2MB
MD5af9a214eebfb4d6a99a82481103c111d
SHA1ad05aa5b195f08e3a73622c60d2b434a90915136
SHA256b61063a385a745fa5d0dce9ed3bcf09c9fcbb3df8491720c8f513bfb6db0e24f
SHA512cec26f9294c9519a451f0f52b3b9eb1d3c4dd2b8647efabe9b56c06f95257d49f38b78b3f5cb90df1120cae536292a677833e4a00c36a6f063df8049f77513cf
-
Filesize
5.2MB
MD57d97606a62945489bc4377b8555cbb4c
SHA178c1812a70d5eb010287350f30e51b0d8d2d1550
SHA256e3c4a06f492c311ba7db6c09515e9493487e3ea72c3bf0778fd9f2578e3c4653
SHA512fb035d1035038896bba85007c6d5103404da81b591dd655f3e33a39d379d94c5e70eaa830c8c2438abc8ebca0ae851ae816a31e67fa9627f87d6d1483515b0e3
-
Filesize
5.2MB
MD5ec7374ec1a3b6ed0a4ab518ac52e6bc1
SHA1f8be74b1937eb064552c16193062e446272cddb6
SHA2564de89d5c27f35a4c995d66aa6deed88c365a03affb4af39898d17968b708b4a0
SHA5125b332416b0aeda907ba32916c8d670b6764cc03e85c1e3a8d24e9737883f843ff6fe9ca66835c3ee7c8d9089b58bf967a6b38a2e998c975e62a76cb48ba19089
-
Filesize
5.2MB
MD5b07e3b6fcfa1e735d621a2d26950c156
SHA14f4882e43b5abd846595963680326a4186d267fe
SHA2569421cb2294cdf31f11b52f66201d5d0050d51d08e22b158fc29d4d5291751cf3
SHA5125e9665ae07c2cda249bd428186ad0308e52874824d6ad66fef5be9ea9e15b4db256b90780ab634906afba41deccecafc45c4b6b3da4263bbd6862ae626458733
-
Filesize
5.2MB
MD515cac0d6fad89a04c33034db5f525ad5
SHA10b3cd0c4ce0a86cc7e0c0068f94b796c1a8bd3b6
SHA256992962a6b22269713b7f288cf49a44dd33c135b957701280bc4f169076eb909f
SHA512db4e7fbc343083d70db8884526c9ba93e4ae61de460ef9e5ee86007f781acde60e88704d129c8d4e685543256c57561ae08cc17643c944c3ac7d9aed1ac0eebf
-
Filesize
5.2MB
MD5281da36487bedf18b726da5a5cf98573
SHA161dfe26b32367146dbe87d35d2ae198aa0a92c72
SHA256a2f95dd74a9052932aec73438d858e44a31d3629a232c2fa205f7a264e7dd5e7
SHA51226b367d9f99d1ba1673146f2d8741d9824e800bf315c1f70101de9248505ae70b1cbdd810c4c93173449a72c12f7675ce581d989e385ec64efdf8c630e798fd4
-
Filesize
5.2MB
MD53c7aa1851bcb3e0e1c7fd27440b0fa81
SHA1becca0f7e8bb397980cced32fc4fb53bd1b56e39
SHA2561ed1be14c25a2868588d44d389a6f6134303a88fe1ff6fab01b19aa82c85e0f8
SHA51218a3e5b47f020475d370b74481e5799c70dd90e649d3dbcd9b6c01b865dd372a730491f3ecce36e35fe459a09c418ce94b0636c365fc0895c5b2cd4d7516f239
-
Filesize
5.2MB
MD5e099e77ae0b573fb7a7730f51e4630cf
SHA1c83d471cb33c332c03ee21fa5a6d7162194fd867
SHA2564c59c689170b1b6cc96bc1544fbf2d24ff4ae5ba5107feaac5fe7e0c76cac7d2
SHA512a725fd1de6be2e3055034a7db1aa31bd20b18e37bdde64d291ff64b200a36e02473210cbf2e542b840904e0f911a38884ccbb2528aadd75b801da4b308036ebf
-
Filesize
5.2MB
MD5305397b4c9f4da09296dafee68bda3d8
SHA1c6cf1a10cca0987514fa9ed4843a3972922c2790
SHA2569a92d15f163f4d739b504deb4d10eb2867d7a86afcb2cd193e2721d50afc4df6
SHA512310c2172409d034b23b7be52ecdedec843080a17ff5497046e6f697602be4b429da0a877e809d4791585df5579d19e5a4638334db0673bd3abc337ee9cfd29e0
-
Filesize
5.2MB
MD5f9b13824ff26ad05bc4d86f119cd72f6
SHA1774373fc75c1ba5066514e93deedf201de5f773b
SHA2567601adbb215ef353619667f1f7eecf72ab1b38631e72c4b8ae9d69c864432d43
SHA5121a35e674030e5715a22b1ba2a3c10efe7e8eaa35a134f02e9121c7fa1932b937cee3fa6412bff92b97f84edcb360dafe261c4677a8d9242d001d9b6de7637f12
-
Filesize
5.2MB
MD5c1cec5ccd55edb837e79da116d8a24d5
SHA1cdc219557f8596c00397be1be124788dc5f7326e
SHA25616519495755edb1d490819666bc3ff4ffe08f03717ba70d2b865ac30a6f57ffc
SHA512bd740f6ecdcad8713585c31351dbb5958c3534c5eb110847b37009bdb6c50ceebdb5bec4b23b3c44e9d1300689a5ae2c0193934b04e81bf818143722ac5be6d6
-
Filesize
5.2MB
MD5c5aca6f99de922d5d0ecf6405b729515
SHA130b7782979190fba841748a50fa6fa5a9de66543
SHA2564804f30c61834590ba6ac04f24552b7325e5f8d37659f45a63ddfd26dc876140
SHA5121dddc8da0291e5a86d82f60ca9d4222a4d2397e92af036c31ab92e78330a66ba8e76075ecdfe4f6c8380bb7512586aa4682af51433516240f22763618d033b8b
-
Filesize
5.2MB
MD5dbd90321c034d4835337cb931e611502
SHA19312cc660ff60301c62ea2d501ad5911a11de402
SHA2568a4726b88a14d3a66fb90d316ce838abe43e7bf69807769cfb1a00e7919a6578
SHA512ac215f32267391c4bba480cdaea51669d37dd63c7da81e02aa2dab661721b82e9c8749edc93e21dbd401f9aecfd14e324fcf8b2d62a99fe874c9d344ea6304c1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB