Overview

overview

10

Static

static

10

2024-05-27...ke.exe

windows7-x64

10

2024-05-27...ke.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-27_b8fcda374af72ad2161f20e6ba7503d9_cobalt-strike_cobaltstrike.exe
  • Size 5.9MB
  • Sample240527-wst83acg21
  • SHA256 55d03d48cd050dc88739c520514c649046b38b4573fc1dde9ec4a0d180a52ada
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikexmrig0backdoorminertrojanupx

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 13 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 13 IoCs
  • UPX dump on OEP (original entry point) 49 IoCs
  • XMRig Miner payload 53 IoCs
    miner
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 52 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-27_b8fcda374af72ad2161f20e6ba7503d9_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-27_b8fcda374af72ad2161f20e6ba7503d9_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\System\lVgZfmj.exe
      C:\Windows\System\lVgZfmj.exe
      2⤵
      • Executes dropped EXE
      PID:2836
    • C:\Windows\System\hvgEdyf.exe
      C:\Windows\System\hvgEdyf.exe
      2⤵
      • Executes dropped EXE
      PID:2616
    • C:\Windows\System\wUNZGcP.exe
      C:\Windows\System\wUNZGcP.exe
      2⤵
      • Executes dropped EXE
      PID:2864
    • C:\Windows\System\IAkIqhS.exe
      C:\Windows\System\IAkIqhS.exe
      2⤵
      • Executes dropped EXE
      PID:2684
    • C:\Windows\System\rUvgYBx.exe
      C:\Windows\System\rUvgYBx.exe
      2⤵
      • Executes dropped EXE
      PID:2724
    • C:\Windows\System\KnbJsKR.exe
      C:\Windows\System\KnbJsKR.exe
      2⤵
      • Executes dropped EXE
      PID:2664
    • C:\Windows\System\HKqcDeg.exe
      C:\Windows\System\HKqcDeg.exe
      2⤵
      • Executes dropped EXE
      PID:2028
    • C:\Windows\System\swsOrNB.exe
      C:\Windows\System\swsOrNB.exe
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\System\BGwanBV.exe
      C:\Windows\System\BGwanBV.exe
      2⤵
      • Executes dropped EXE
      PID:2424
    • C:\Windows\System\ASNwXTz.exe
      C:\Windows\System\ASNwXTz.exe
      2⤵
      • Executes dropped EXE
      PID:2496
    • C:\Windows\System\AcYKSht.exe
      C:\Windows\System\AcYKSht.exe
      2⤵
      • Executes dropped EXE
      PID:2472
    • C:\Windows\System\TEiCaTO.exe
      C:\Windows\System\TEiCaTO.exe
      2⤵
      • Executes dropped EXE
      PID:1172
    • C:\Windows\System\YfaqlWC.exe
      C:\Windows\System\YfaqlWC.exe
      2⤵
      • Executes dropped EXE
      PID:1392
    • C:\Windows\System\iWGESqs.exe
      C:\Windows\System\iWGESqs.exe
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Windows\System\PQekvXV.exe
      C:\Windows\System\PQekvXV.exe
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\System\QDXITov.exe
      C:\Windows\System\QDXITov.exe
      2⤵
      • Executes dropped EXE
      PID:2268
    • C:\Windows\System\hraVomt.exe
      C:\Windows\System\hraVomt.exe
      2⤵
      • Executes dropped EXE
      PID:2760
    • C:\Windows\System\ONmcIDO.exe
      C:\Windows\System\ONmcIDO.exe
      2⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\System\kwrruvE.exe
      C:\Windows\System\kwrruvE.exe
      2⤵
      • Executes dropped EXE
      PID:2832
    • C:\Windows\System\UTTlyuL.exe
      C:\Windows\System\UTTlyuL.exe
      2⤵
      • Executes dropped EXE
      PID:1028
    • C:\Windows\System\KiITmwD.exe
      C:\Windows\System\KiITmwD.exe
      2⤵
      • Executes dropped EXE
      PID:1848

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ASNwXTz.exe
        • Path C:\Windows\system\ASNwXTz.exe
        • Size 5.9MB
        • SHA256 53da465f75c8bf713a60e5fa061be37f64eb73c888f1acde22ec4ea269649786
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AcYKSht.exe
        • Path C:\Windows\system\AcYKSht.exe
        • Size 5.9MB
        • SHA256 8ed39dab3f47832a751492036af8301f4885862d29803cf620a1ceac220c4d43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BGwanBV.exe
        • Path C:\Windows\system\BGwanBV.exe
        • Size 5.9MB
        • SHA256 8397e4df574c96ed0bf61ab8d7494e7b1191428d6a2f6ac4247c800378e43c36
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IAkIqhS.exe
        • Path C:\Windows\system\IAkIqhS.exe
        • Size 5.8MB
        • SHA256 0d4a824efda706db87b77805c320758f4772451fa0404efc091a4e3040c61068
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KiITmwD.exe
        • Path C:\Windows\system\KiITmwD.exe
        • Size 5.4MB
        • SHA256 b26b72ca0ef6d18aef032253470a78a13f48dcd486b2eb6e1570c96324293e82
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KnbJsKR.exe
        • Path C:\Windows\system\KnbJsKR.exe
        • Size 5.9MB
        • SHA256 37dd63fa608e19033cbf1d6fe95b6c7cae69d9504fa48e33d41d5ec13ee264fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ONmcIDO.exe
        • Path C:\Windows\system\ONmcIDO.exe
        • Size 5.9MB
        • SHA256 09f9d78b52041a781342402d5c596c3ea15577e11a90bea7dbf6b09a0ab8af29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        QDXITov.exe
        • Path C:\Windows\system\QDXITov.exe
        • Size 5.9MB
        • SHA256 f3acd82830976bea178f2395f729a89691bb342cb7aab598203c377d531ec3af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UTTlyuL.exe
        • Path C:\Windows\system\UTTlyuL.exe
        • Size 3.3MB
        • SHA256 0632369166c9bc5c9b434ffd89ec9c9f265e35db5f9f6e8b7957c45b2c7683c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lVgZfmj.exe
        • Path C:\Windows\system\lVgZfmj.exe
        • Size 5.9MB
        • SHA256 05dd3d926d8f7a6b3411e38a31ef4f8229eb7d780b830e3fca3bbab5124eef86
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        swsOrNB.exe
        • Path C:\Windows\system\swsOrNB.exe
        • Size 5.8MB
        • SHA256 1ee51685b7af314df3c8f01c4b39b91c739a420b0c8968c9cd986b716fd08dc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wUNZGcP.exe
        • Path C:\Windows\system\wUNZGcP.exe
        • Size 5.9MB
        • SHA256 822a9a0f7461db5401647fe28394a2038422fffbca2ea477c5d945633efff057
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IAkIqhS.exe
        • Path \Windows\system\IAkIqhS.exe
        • Size 5.9MB
        • SHA256 cadaec1ba090c1a37fd0dcb191aa0b8f6b77d91b4395e860abf5b57c3d338ccb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KiITmwD.exe
        • Path \Windows\system\KiITmwD.exe
        • Size 3.0MB
        • SHA256 66cd4cd4af8f630e7f196e1d09756e078751dfa9bcc54e0d14fae0ccbe492285
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ONmcIDO.exe
        • Path \Windows\system\ONmcIDO.exe
        • Size 5.6MB
        • SHA256 ddb3f57945f3929208b2b32e9fb1bc992b84f62c9f6d825404b952bbb20eee72
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PQekvXV.exe
        • Path \Windows\system\PQekvXV.exe
        • Size 5.9MB
        • SHA256 7ffc7610319036669a6e39401e49cc6408a3fc3cd52ac5f59e888f0860a60c06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TEiCaTO.exe
        • Path \Windows\system\TEiCaTO.exe
        • Size 5.9MB
        • SHA256 ef11b636fa48a677d5e28d45df64d29790a2b31560b2909879b4fd5734d1d692
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UTTlyuL.exe
        • Path \Windows\system\UTTlyuL.exe
        • Size 5.7MB
        • SHA256 15b21f96ab3bc949c328ae89ca4b8971cb600187d8a414a03ad62deea81f4ef1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        YfaqlWC.exe
        • Path \Windows\system\YfaqlWC.exe
        • Size 5.9MB
        • SHA256 2302e88ae0a54b7163f93a4e54e4ffdb91b7cef3d88634803f6a543259a6216d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        iWGESqs.exe
        • Path \Windows\system\iWGESqs.exe
        • Size 2.3MB
        • SHA256 54a48f3a9df4f2d2df5308f04d9bbc5bfb754b7f4236b7d31d49f71134f2b309
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kwrruvE.exe
        • Path \Windows\system\kwrruvE.exe
        • Size 5.9MB
        • SHA256 1cc51492361df0409c34002146ed0cbc18c78ed806e3e39994c74ac9a95fb2ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rUvgYBx.exe
        • Path \Windows\system\rUvgYBx.exe
        • Size 5.9MB
        • SHA256 84fa29facf1797205a948863e1063e652e34263872f2062c48883aeb4ed50c85
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1172-125-0x000000013F7B0000-0x000000013FB04000-memory.dmp
        Download

        memory/1172-145-0x000000013F7B0000-0x000000013FB04000-memory.dmp
        Download

        memory/1392-124-0x000000013F220000-0x000000013F574000-memory.dmp
        Download

        memory/1392-144-0x000000013F220000-0x000000013F574000-memory.dmp
        Download

        memory/1712-128-0x000000013F5E0000-0x000000013F934000-memory.dmp
        Download

        memory/1712-8-0x000000013F610000-0x000000013F964000-memory.dmp
        Download

        memory/1712-74-0x000000013F160000-0x000000013F4B4000-memory.dmp
        Download

        memory/1712-1-0x0000000000480000-0x0000000000490000-memory.dmp
        Download

        memory/1712-130-0x000000013FB20000-0x000000013FE74000-memory.dmp
        Download

        memory/1712-129-0x000000013FF50000-0x00000001402A4000-memory.dmp
        Download

        memory/1712-21-0x000000013F170000-0x000000013F4C4000-memory.dmp
        Download

        memory/1712-0-0x000000013FB20000-0x000000013FE74000-memory.dmp
        Download

        memory/1712-127-0x00000000022A0000-0x00000000025F4000-memory.dmp
        Download

        memory/1712-78-0x000000013F030000-0x000000013F384000-memory.dmp
        Download

        memory/1712-126-0x000000013F2B0000-0x000000013F604000-memory.dmp
        Download

        memory/1712-29-0x00000000022A0000-0x00000000025F4000-memory.dmp
        Download

        memory/1712-99-0x00000000022A0000-0x00000000025F4000-memory.dmp
        Download

        memory/2028-139-0x000000013F160000-0x000000013F4B4000-memory.dmp
        Download

        memory/2028-82-0x000000013F160000-0x000000013F4B4000-memory.dmp
        Download

        memory/2424-140-0x000000013F3B0000-0x000000013F704000-memory.dmp
        Download

        memory/2424-95-0x000000013F3B0000-0x000000013F704000-memory.dmp
        Download

        memory/2472-123-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2472-143-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2496-122-0x000000013F860000-0x000000013FBB4000-memory.dmp
        Download

        memory/2496-142-0x000000013F860000-0x000000013FBB4000-memory.dmp
        Download

        memory/2588-121-0x000000013F030000-0x000000013F384000-memory.dmp
        Download

        memory/2588-141-0x000000013F030000-0x000000013F384000-memory.dmp
        Download

        memory/2616-18-0x000000013F170000-0x000000013F4C4000-memory.dmp
        Download

        memory/2616-131-0x000000013F170000-0x000000013F4C4000-memory.dmp
        Download

        memory/2616-134-0x000000013F170000-0x000000013F4C4000-memory.dmp
        Download

        memory/2664-65-0x000000013F2B0000-0x000000013F604000-memory.dmp
        Download

        memory/2664-138-0x000000013F2B0000-0x000000013F604000-memory.dmp
        Download

        memory/2684-28-0x000000013FA50000-0x000000013FDA4000-memory.dmp
        Download

        memory/2684-136-0x000000013FA50000-0x000000013FDA4000-memory.dmp
        Download

        memory/2724-137-0x000000013F560000-0x000000013F8B4000-memory.dmp
        Download

        memory/2724-132-0x000000013F560000-0x000000013F8B4000-memory.dmp
        Download

        memory/2724-35-0x000000013F560000-0x000000013F8B4000-memory.dmp
        Download

        memory/2836-133-0x000000013F610000-0x000000013F964000-memory.dmp
        Download

        memory/2836-12-0x000000013F610000-0x000000013F964000-memory.dmp
        Download

        memory/2864-135-0x000000013F190000-0x000000013F4E4000-memory.dmp
        Download

        memory/2864-26-0x000000013F190000-0x000000013F4E4000-memory.dmp
        Download