Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-05-2024 08:23
General
-
Target
2024-05-25_00e8afa1eed42a9e73248429187371fe_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
00e8afa1eed42a9e73248429187371fe
-
SHA1
27a054962930c4f13fadb9403009c78b7fdee56a
-
SHA256
38c50fa6149473a29aacea33f6cde4d805b40bb4a20144dbcc7804ef992a41b2
-
SHA512
9f816097420eb59b5fff23e282dd865f464e56e51e44f375c49139cebaaad3e7ed660310c7e7cbf03e9417cb3da004ef8b9119de52da9cf83d095113413807cd
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 53 IoCs
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_00e8afa1eed42a9e73248429187371fe_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_00e8afa1eed42a9e73248429187371fe_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yappvTG.exeC:\Windows\System\yappvTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HIvoUKb.exeC:\Windows\System\HIvoUKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDNYFkt.exeC:\Windows\System\PDNYFkt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\scNKyTa.exeC:\Windows\System\scNKyTa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VEAJTUx.exeC:\Windows\System\VEAJTUx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzEOxSD.exeC:\Windows\System\hzEOxSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLccSeT.exeC:\Windows\System\aLccSeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsojnoF.exeC:\Windows\System\xsojnoF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPfUqHq.exeC:\Windows\System\zPfUqHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMieJxl.exeC:\Windows\System\lMieJxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLsKkNE.exeC:\Windows\System\mLsKkNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iejvxiu.exeC:\Windows\System\iejvxiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jqQrqZQ.exeC:\Windows\System\jqQrqZQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\csjEHEP.exeC:\Windows\System\csjEHEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khNbxyL.exeC:\Windows\System\khNbxyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MtmYjTy.exeC:\Windows\System\MtmYjTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJSZQkI.exeC:\Windows\System\NJSZQkI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YAVxWyg.exeC:\Windows\System\YAVxWyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XFVYejK.exeC:\Windows\System\XFVYejK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SXCKOLf.exeC:\Windows\System\SXCKOLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjIWVuj.exeC:\Windows\System\PjIWVuj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5a39aff769ebaefdad5d24eb3cefac95d
SHA1c30a828ab3e2ae12112ce6f24242eb66ea0aea72
SHA2566a7cabe68a4bd017b0580c89b64b8f0941407111a6e4b2d80a2b411d8f3c603c
SHA512776775839bd1659c8b1598b7594b2e502a21bbab17d176fe15105e12422b4c12d0f8b2fea13b61a532a11601ba6e64de049952175faba72ad2395c1ffd1e6447
-
Filesize
5.9MB
MD54a7fdb140a9c94d5cc7f9d84cdc00724
SHA13e37b661083fc4bde99b1a5b143f5c4405f0d530
SHA2564e0c06681128d96225e5a5738d4b6f50ff83cca765c62753abcfb4317a0bb037
SHA5129f9fd61638862a1bdccb78d8caf4a929f0f2ac70ee24c47806da5b2aaa2353d8ec601e494b17b3ee6aa1928f808d35ad1476b9c0588d08b839d6778460c9fd54
-
Filesize
5.9MB
MD5978d7ae0c7f621e9c72ebeb6c4f7afbf
SHA14a91a198aae7a28b5b5620ffd3f0b25391a12d7f
SHA25686e3360760a4ea94fa35302ee1e36a82ee76f5d917ddb62397c58630770369d6
SHA5127cf647e8e7a624e63ff5fb9f55f3e159f279a44d34f235172d3d0e09df6d849938920906874ed3a7c95cc2c617c5d5ba2ff1f9a5e103f72f990482d0ce317c59
-
Filesize
5.9MB
MD56676fb4320b8925b255a9a3fbd96c554
SHA1353f28270d2865f8ede8c4d821df44f0b27ca700
SHA256f6ec6eeab812cf0d0e8d8eb9177d55178e9d88e5e188da7bf1c9eb9d18e1ecc5
SHA512a5f73fe48d2ce41c78d804ab0e6e15ddf4d61a2a768dee302a78049c15d4f88d43d0ec2b24355a2ccf69144e9885729666b0b042442c3bf68a1a379eef3c11ac
-
Filesize
5.9MB
MD5959858bd774b4e2434d357fe388a7464
SHA18b960bd602f99a75bb5cc9122195f7916680d28a
SHA256a31e7326b4386f9e483c50aadad41c1b600aba5d271b0bd1f3373f8ae6141d90
SHA5124267b334066d4738e0c3a0410e464c21066ea5c6073e269bf1996961e322aecb0fb15d938c3522fe6dfe33592779a1800ca1e015763440a6007bf8560140dd18
-
Filesize
5.9MB
MD5430a2a688d6cdab04db68da2b93415a0
SHA1b4be68f40a6b8e3746e9fa0ddcc243b689cd93b8
SHA256336d219b5d2e2841e52881dc84ddb8a51801f43dee58c4b99568eb2a7fb90bfa
SHA51260ca58166e1ca869eda92e9643d1a363fb20dfd575f741c85fa6c93339ebcb34b4e74bd7b346683076cbd56718f68b18abf80ca4f5f417fb67ea3fbb5ec94588
-
Filesize
5.9MB
MD5bd8545bebc12e2ec9f1ee6fa38ddfd37
SHA19be1e35b5db9ba7adef3534341ff9304bd2e702a
SHA25689cf946b643d4cb192ab69d78796785a7ac687ec984fd119279696ad095e5d60
SHA5124db308ac9757823f725292ee0e4e93383ec880c4ed10772e7fdc8d4ac39674b410759c418fec9e0b5900ba7d537be125002cedae2e5eab3414712bbb8f4fce27
-
Filesize
5.9MB
MD57a9267c65e8521045127862b7faf3490
SHA1f33caeae14b9fdae289b445ed5f69bc328e83452
SHA2567aabcc8ac27f41abccb6a36df49be624d56110b3bde2397fa54795cb21d3e00f
SHA512ec91bf5222280be82627d74f20d6560b3148b26f0380b1451a5302291b88671476140a13fca90a5e93969bc1b8625ed1d8185dbb2b8ab8f37acd909d6dfdb638
-
Filesize
5.9MB
MD52dd31a555b2020424d5bcbd41b973479
SHA110a4797c2cb7cd1b574d173cae0ba10c5d306a0e
SHA256eaba712bc810e0817c43ae721fbc9081817c164cc830bf617969cd4abd7eb04f
SHA5121a88095ccab679914b2b7e0673f7c26a405c754d97d7da85dd4daef48332ea0831744c8926053892d0f6b3ebf75c6e0f3f1ddb0fdcd788d29d18b10a97a2a6b1
-
Filesize
5.9MB
MD5e87000fc519f588ef2b693d850d47272
SHA1a1e3089df24550de2dfb32c434d58a60e669eff4
SHA2562c48f4c32c29604358bc3c626b9e1ed4c2b3c835635e765343cd035cfa94183a
SHA51232bfe38cb40b6642dd60b0cf9541c47746ddaf930e6b6624fd3edb69d2093308ad7820ce546f1dd402029c2413bb9e389b32d92a764ecf8d17a14b88b2b81d22
-
Filesize
5.9MB
MD56ec5adfb7d65a0668123898f3d15f33e
SHA1b9a334c9e6877c46be8d2f7ed30dd3ab1cc896df
SHA2567780a81b6f9f2fcef8cd8719b3b14c4afa7ef1d2695c94c8bf694a6e076b02b1
SHA51217904fecd2467d3e85004ba953ebf66151d645bafb5888bcea354af7871b306660828ca8f3f9a7c122554cab659674fba6e148f8bbfddf27d30632e273ddc326
-
Filesize
5.9MB
MD58dc60d6b9e294a83f3eeeefce8985359
SHA1d9bf25a613e11c6036b422f973ae9910785ebf81
SHA256618afeb4b5d3d575d0179f5f17cf9572798c1df85f2e7f77b7b579e434652610
SHA5128d234fedf3c94b889881cfebd9b56b89e3eb2fb249b7a0ffa06d85c421bf1b1a182ba291ad89e3aeacff8f7e31c7fd4e494c0680a79e37cf368b978b864369ac
-
Filesize
5.9MB
MD55b320102bacf075d231e9b3d14743e17
SHA15fe2965e6e4a3d926668b68ede8e540fb5560136
SHA256a3d248f14984c78861c86168fa9752454d81b22b3a7bcf3b93d86218feb17056
SHA51232e525c5cc213c90a5bfbe258f231fbe4c9136a416341887bd13619336fd7a15687bf94eaee2062fe69791ad8508fb90c5e389faaba05ada7726751d1c88ca6d
-
Filesize
5.9MB
MD542da29ac6298157324bddede9e4dd618
SHA11bbfc1ca5b5caebe3cbfa27d3f2c3ff6bba752fa
SHA2565671c68688d5b0432e2a2f91534471bb02be70d8408e6fe675458b9f9c470e7b
SHA512ffc82ffe9a89285ab90139d7d30a72655d4a32adf8cc2b828671b7aa0ab870f8bea5905e40530f89eeea48dab66cdeaad38c38d5628036c53b7e751c50f0e9b2
-
Filesize
5.9MB
MD5a9ba7da5008251598a708963b24d3195
SHA1c97db99d3e5a0117b59a056e7203c81d9e2f071d
SHA2562163a9cea793e148d809099a45703af29f45f450cedd94b490c298354f99c6e0
SHA512e96d463f17ef8685d0e89398f3a4351538addba39f5d074bffdf3f1a676bd68da10fe35cd30d52c540152dd9a3d96903ed896b4f1a0ff65d2d422f6c68f0119f
-
Filesize
5.9MB
MD55e42702a2736d31a443f6156f327c9ba
SHA1b867be0b8483d561f6d31ba6a005fffb6fdf4a87
SHA256e1b9302fa16c69a2f59dcdf379b6c9f56a1418faaf15ffe5efd3d828fd70cb18
SHA512aa40a52fc2d4842d199e37c5234cd940f38508b2a8cc8f38d4324ccc5d307b319cedefce33eaff2af4cf9c39f5ad03b7114a950087cfc2a54b1655cdf8f027a3
-
Filesize
5.9MB
MD585b896907880f081ce20c9b22f14a294
SHA1e514438d177799797a25605af337e664937efbd8
SHA2567638dee05fd4d5e1b50df40a36237f6b55248f2981bb34e7640918f6bb69ed3c
SHA5128b9eec52d0ca5c51c59f9e334a809f8403dd8b12d53c1bdcd7a5c8486a070d8a7fee9c610e91b4bebcbae4ca9854379d081bcc032dff5c7f2dca28df9082b8ee
-
Filesize
5.9MB
MD564110be59bb76382cf0db26a410aa7a2
SHA1b62838b4d013589d5b56af700d16a73205140bd3
SHA2560aeeff326e0c2af254be945bbb699594a7031b09b5e38244345fcc0b18919dd0
SHA512f5176277423d7b4d46f5310838a5ce18fff91021f9062d56d2d790d783150635165f7abeafde379d1eec8e51b103bf4554d63d44cded65d1339dd9a4f42e7196
-
Filesize
5.9MB
MD5f95c510653c0d3357b655f8f20fa1448
SHA1bbbcadf9d7fdf4f4bb1890f3f6a69e34a079845f
SHA256ecbe69ac21f63442639989584e76b0a9d652f1e7d98fe4f7c4c31bb1c6e25121
SHA512a5efb1be281bf15d3a6aa7ca3143765a3f7790f69bd3f549bf86bcf500d8e6afbb96c4a16108e7ca08251837dcd6aa5c040392164acf79401e10d386aa1badff
-
Filesize
5.9MB
MD58a828a322b578a5895a760e81ecebf89
SHA15f583e09b36aab597ccb47c29b0a8f7b22d01eec
SHA25651587ab8553b558e4f22446bbd9926e6d8a3f80040cb07567c2e93d575137b13
SHA512b146d6731b3ba5a0c12e554a795c7862939845d4d11bfff6173bee1011f8de22957ae0e5e87f3501ea67c9c7e049699986c49942a6ac38168ced2633cf408176
-
Filesize
5.9MB
MD59a180bd65e0523f6139067c59de207d9
SHA1ef08a9089f6ac0d04a2d344db435c8ce6be85f45
SHA256c41857fe7dcbe2fea25a1481d39f2e401b308ef989fd53f037b648c123b88e63
SHA5123053bb4b4608d1b7218d3a4634f56275214fe9e90ac1f55fd415ed5ae228fa54ecc2237dd27e7f844bdb986f483f258e5e5c37b8a02cbf18cdfb975795968b05
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB