Overview

overview

10

Static

static

10

2024-05-27...ke.exe

windows7-x64

10

2024-05-27...ke.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
  • Size 5.9MB
  • Sample240527-wcjsdsca7x
  • SHA256 451e7d32777061de43a5fb3d3c982ba801cb3ea62fac22d71af49dc52715c2b9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikexmrig0backdoorminertrojanupx

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 21 IoCs
  • UPX dump on OEP (original entry point) 58 IoCs
  • XMRig Miner payload 62 IoCs
    miner
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 58 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\System\RyaAart.exe
      C:\Windows\System\RyaAart.exe
      2⤵
      • Executes dropped EXE
      PID:2448
    • C:\Windows\System\ELCWnaR.exe
      C:\Windows\System\ELCWnaR.exe
      2⤵
      • Executes dropped EXE
      PID:2912
    • C:\Windows\System\HeKDwsb.exe
      C:\Windows\System\HeKDwsb.exe
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\System\eXjyWZh.exe
      C:\Windows\System\eXjyWZh.exe
      2⤵
      • Executes dropped EXE
      PID:2620
    • C:\Windows\System\QrVXtoV.exe
      C:\Windows\System\QrVXtoV.exe
      2⤵
      • Executes dropped EXE
      PID:2484
    • C:\Windows\System\OApGcMK.exe
      C:\Windows\System\OApGcMK.exe
      2⤵
      • Executes dropped EXE
      PID:2472
    • C:\Windows\System\nUaTYZA.exe
      C:\Windows\System\nUaTYZA.exe
      2⤵
      • Executes dropped EXE
      PID:2456
    • C:\Windows\System\PifCZwU.exe
      C:\Windows\System\PifCZwU.exe
      2⤵
      • Executes dropped EXE
      PID:2356
    • C:\Windows\System\YCiLWEk.exe
      C:\Windows\System\YCiLWEk.exe
      2⤵
      • Executes dropped EXE
      PID:2428
    • C:\Windows\System\dZVLfrN.exe
      C:\Windows\System\dZVLfrN.exe
      2⤵
      • Executes dropped EXE
      PID:2420
    • C:\Windows\System\KcCKmmy.exe
      C:\Windows\System\KcCKmmy.exe
      2⤵
      • Executes dropped EXE
      PID:1188
    • C:\Windows\System\JttvypX.exe
      C:\Windows\System\JttvypX.exe
      2⤵
      • Executes dropped EXE
      PID:1280
    • C:\Windows\System\vmipcGq.exe
      C:\Windows\System\vmipcGq.exe
      2⤵
      • Executes dropped EXE
      PID:2672
    • C:\Windows\System\ohWPxUg.exe
      C:\Windows\System\ohWPxUg.exe
      2⤵
      • Executes dropped EXE
      PID:1452
    • C:\Windows\System\PUROHti.exe
      C:\Windows\System\PUROHti.exe
      2⤵
      • Executes dropped EXE
      PID:1020
    • C:\Windows\System\YWhbHMF.exe
      C:\Windows\System\YWhbHMF.exe
      2⤵
      • Executes dropped EXE
      PID:2108
    • C:\Windows\System\eZyQnBW.exe
      C:\Windows\System\eZyQnBW.exe
      2⤵
      • Executes dropped EXE
      PID:2116
    • C:\Windows\System\bfZHCkG.exe
      C:\Windows\System\bfZHCkG.exe
      2⤵
      • Executes dropped EXE
      PID:2088
    • C:\Windows\System\hruLRWF.exe
      C:\Windows\System\hruLRWF.exe
      2⤵
      • Executes dropped EXE
      PID:344
    • C:\Windows\System\UIzvxRu.exe
      C:\Windows\System\UIzvxRu.exe
      2⤵
      • Executes dropped EXE
      PID:2796
    • C:\Windows\System\IAwAoFw.exe
      C:\Windows\System\IAwAoFw.exe
      2⤵
      • Executes dropped EXE
      PID:2720

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ELCWnaR.exe
        • Path C:\Windows\system\ELCWnaR.exe
        • Size 5.9MB
        • SHA256 d38d9ce9b71fb587515056239cd02fe8b5b47dad630800a367a5952ef568f929
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KcCKmmy.exe
        • Path C:\Windows\system\KcCKmmy.exe
        • Size 5.9MB
        • SHA256 817b51b18bd5a36360f807b62c260ea0ee9e9c4445cfc48e036a56bc2e515553
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OApGcMK.exe
        • Path C:\Windows\system\OApGcMK.exe
        • Size 5.9MB
        • SHA256 77d1125c980b7a1d0a548859636d8ce58ad2c2c358dd7a41f10672a2b94e84c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PUROHti.exe
        • Path C:\Windows\system\PUROHti.exe
        • Size 5.9MB
        • SHA256 e556a87f4979c6d052813f09461553ea91e386b5a50f7ba510e1643cb00e8eb4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PifCZwU.exe
        • Path C:\Windows\system\PifCZwU.exe
        • Size 5.9MB
        • SHA256 8ef79355e880b5cb8544af85a2bf56859ea7e4e694515591630938df6af8c361
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UIzvxRu.exe
        • Path C:\Windows\system\UIzvxRu.exe
        • Size 5.9MB
        • SHA256 2b31517885a2f4d6d4f3c9792199d1add251924b190fba135b43a464f30b0eb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        YCiLWEk.exe
        • Path C:\Windows\system\YCiLWEk.exe
        • Size 5.9MB
        • SHA256 31343b527661a8bc0c69c943dd8b75576c50d3bf087dc7339a3ce8c0d5d756e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        YWhbHMF.exe
        • Path C:\Windows\system\YWhbHMF.exe
        • Size 5.9MB
        • SHA256 a1553c5dcd988b52d20b401120e3f5332cf17fb351c24fad72920b0c877c4e87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bfZHCkG.exe
        • Path C:\Windows\system\bfZHCkG.exe
        • Size 5.9MB
        • SHA256 6d2a5948452bcfaef0b9100361eb75618751b7cf8c6fe9a8f828995e62fd990c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dZVLfrN.exe
        • Path C:\Windows\system\dZVLfrN.exe
        • Size 5.9MB
        • SHA256 3c9a3bf28f040a86159dbb30393d38e912e3c47d4e52001bbed6a516055d883c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        eXjyWZh.exe
        • Path C:\Windows\system\eXjyWZh.exe
        • Size 5.9MB
        • SHA256 7bbba67eec1d7bbbe56bb4750c4923f0923f34baee0272bc7afc7ccb53636c9a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        eZyQnBW.exe
        • Path C:\Windows\system\eZyQnBW.exe
        • Size 5.9MB
        • SHA256 e9b47caa341c12caf3e7097575a41add7c726ca0753d0764c6ed92ebc91cbb39
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hruLRWF.exe
        • Path C:\Windows\system\hruLRWF.exe
        • Size 5.9MB
        • SHA256 6c5fd6342660ea411c58e6b082d78ea2f12c7401701997ad4bd12157cc874860
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ohWPxUg.exe
        • Path C:\Windows\system\ohWPxUg.exe
        • Size 5.9MB
        • SHA256 4390c0770ca848391c3c02ccb7db56aae4755bd91f2d9a1d0002a049a2f548ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vmipcGq.exe
        • Path C:\Windows\system\vmipcGq.exe
        • Size 5.9MB
        • SHA256 04f94ab3ad6b740c24903e69381bb62c29c9bf2f7c53a2e8fa7c46d07433c7db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        HeKDwsb.exe
        • Path \Windows\system\HeKDwsb.exe
        • Size 5.9MB
        • SHA256 e6fd8fe6642c0a6136615773368f656ac3c66e4793c9b0a654cbe0d9a04179d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IAwAoFw.exe
        • Path \Windows\system\IAwAoFw.exe
        • Size 5.9MB
        • SHA256 56e2346f5d27510e74d2747f7e5b62c2f4c9103d31f2189c060b9de4ebc14204
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        JttvypX.exe
        • Path \Windows\system\JttvypX.exe
        • Size 5.9MB
        • SHA256 2b1ad2a3dc39054fe15ac3962e40e2bd101601b6da59217ea2b8a2166fdded54
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        QrVXtoV.exe
        • Path \Windows\system\QrVXtoV.exe
        • Size 5.9MB
        • SHA256 bbaac9fa25bf63521b9836d6ce2d877a60a950976e3625204a84d4f3c7ac19a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RyaAart.exe
        • Path \Windows\system\RyaAart.exe
        • Size 5.9MB
        • SHA256 f76c556cd10c1f00ae69bc94dc8c8ab96faf433fc5d718befa8a464963295c57
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nUaTYZA.exe
        • Path \Windows\system\nUaTYZA.exe
        • Size 5.9MB
        • SHA256 e60078e459353aa991b93d6a8d0f99ccd67290b38ac881944b174cbcc98a61e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1188-153-0x000000013FBB0000-0x000000013FF04000-memory.dmp
        Download

        memory/1188-80-0x000000013FBB0000-0x000000013FF04000-memory.dmp
        Download

        memory/1188-138-0x000000013FBB0000-0x000000013FF04000-memory.dmp
        Download

        memory/1280-154-0x000000013F1B0000-0x000000013F504000-memory.dmp
        Download

        memory/1280-86-0x000000013F1B0000-0x000000013F504000-memory.dmp
        Download

        memory/1280-139-0x000000013F1B0000-0x000000013F504000-memory.dmp
        Download

        memory/1452-99-0x000000013F960000-0x000000013FCB4000-memory.dmp
        Download

        memory/1452-156-0x000000013F960000-0x000000013FCB4000-memory.dmp
        Download

        memory/2356-150-0x000000013F020000-0x000000013F374000-memory.dmp
        Download

        memory/2356-56-0x000000013F020000-0x000000013F374000-memory.dmp
        Download

        memory/2420-68-0x000000013F0B0000-0x000000013F404000-memory.dmp
        Download

        memory/2420-152-0x000000013F0B0000-0x000000013F404000-memory.dmp
        Download

        memory/2420-137-0x000000013F0B0000-0x000000013F404000-memory.dmp
        Download

        memory/2428-63-0x000000013F310000-0x000000013F664000-memory.dmp
        Download

        memory/2428-151-0x000000013F310000-0x000000013F664000-memory.dmp
        Download

        memory/2440-136-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-33-0x000000013FA40000-0x000000013FD94000-memory.dmp
        Download

        memory/2440-1-0x0000000000080000-0x0000000000090000-memory.dmp
        Download

        memory/2440-87-0x000000013FD10000-0x0000000140064000-memory.dmp
        Download

        memory/2440-67-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-140-0x000000013FD10000-0x0000000140064000-memory.dmp
        Download

        memory/2440-62-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-55-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-142-0x000000013F960000-0x000000013FCB4000-memory.dmp
        Download

        memory/2440-39-0x000000013F810000-0x000000013FB64000-memory.dmp
        Download

        memory/2440-74-0x000000013F240000-0x000000013F594000-memory.dmp
        Download

        memory/2440-42-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-26-0x000000013FC20000-0x000000013FF74000-memory.dmp
        Download

        memory/2440-0-0x000000013F240000-0x000000013F594000-memory.dmp
        Download

        memory/2440-78-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-14-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-103-0x0000000002360000-0x00000000026B4000-memory.dmp
        Download

        memory/2440-98-0x000000013F960000-0x000000013FCB4000-memory.dmp
        Download

        memory/2448-19-0x000000013FE70000-0x00000001401C4000-memory.dmp
        Download

        memory/2448-143-0x000000013FE70000-0x00000001401C4000-memory.dmp
        Download

        memory/2456-49-0x000000013F490000-0x000000013F7E4000-memory.dmp
        Download

        memory/2456-149-0x000000013F490000-0x000000013F7E4000-memory.dmp
        Download

        memory/2456-135-0x000000013F490000-0x000000013F7E4000-memory.dmp
        Download

        memory/2472-147-0x000000013F810000-0x000000013FB64000-memory.dmp
        Download

        memory/2472-44-0x000000013F810000-0x000000013FB64000-memory.dmp
        Download

        memory/2484-148-0x000000013FA40000-0x000000013FD94000-memory.dmp
        Download

        memory/2484-97-0x000000013FA40000-0x000000013FD94000-memory.dmp
        Download

        memory/2484-46-0x000000013FA40000-0x000000013FD94000-memory.dmp
        Download

        memory/2588-145-0x000000013F290000-0x000000013F5E4000-memory.dmp
        Download

        memory/2588-37-0x000000013F290000-0x000000013F5E4000-memory.dmp
        Download

        memory/2620-146-0x000000013FC20000-0x000000013FF74000-memory.dmp
        Download

        memory/2620-40-0x000000013FC20000-0x000000013FF74000-memory.dmp
        Download

        memory/2672-141-0x000000013FD10000-0x0000000140064000-memory.dmp
        Download

        memory/2672-155-0x000000013FD10000-0x0000000140064000-memory.dmp
        Download

        memory/2672-90-0x000000013FD10000-0x0000000140064000-memory.dmp
        Download

        memory/2912-144-0x000000013F2F0000-0x000000013F644000-memory.dmp
        Download

        memory/2912-30-0x000000013F2F0000-0x000000013F644000-memory.dmp
        Download