Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28/05/2024, 02:47
General
-
Target
2024-05-28_5b022da848e8642900b292882debe9d4_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
5b022da848e8642900b292882debe9d4
-
SHA1
1048595bd5fe60f3b411160909b653aae6e11618
-
SHA256
81e7a296dd70b62bacc74171cdf65a076a2f7e86c80dc9b840c99d7d00de32d6
-
SHA512
07ca9b767209631146f1ea589e062bb2fd88e58edd6d3b8eb211bf41483f765068c3a7ebe76813c3df9f88651b4136c288d9817b6f9ef5a4a6df660b31e9286b
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_5b022da848e8642900b292882debe9d4_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_5b022da848e8642900b292882debe9d4_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oyOuYad.exeC:\Windows\System\oyOuYad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huhLdAN.exeC:\Windows\System\huhLdAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xxQbAqw.exeC:\Windows\System\xxQbAqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MEaLZel.exeC:\Windows\System\MEaLZel.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obkbYrp.exeC:\Windows\System\obkbYrp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUAHZoL.exeC:\Windows\System\SUAHZoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cIMyMZU.exeC:\Windows\System\cIMyMZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONNzxZe.exeC:\Windows\System\ONNzxZe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oAolQCI.exeC:\Windows\System\oAolQCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtGPguj.exeC:\Windows\System\mtGPguj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSifaxI.exeC:\Windows\System\kSifaxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLRlsVf.exeC:\Windows\System\YLRlsVf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIyEjNL.exeC:\Windows\System\MIyEjNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOhDVaR.exeC:\Windows\System\BOhDVaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIlxtVs.exeC:\Windows\System\TIlxtVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJkmoir.exeC:\Windows\System\HJkmoir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OsCwLFI.exeC:\Windows\System\OsCwLFI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWhJtlL.exeC:\Windows\System\IWhJtlL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmOtYQb.exeC:\Windows\System\gmOtYQb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAFWFsB.exeC:\Windows\System\GAFWFsB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsOsFac.exeC:\Windows\System\WsOsFac.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5ee11d9f1113ab091d30516af6cec4819
SHA1d82298b49ccb9b0b36df85cb38e9f60b897662e4
SHA256acb93d0ff35c6d7f9980a479f130bdb96f502ea57f0311f266ffdf8be106af2a
SHA512180020f4377c9821b543bb461840ad2965c400cfd27915cc24db55f128194a266608c5b903a4da7a263afc9870a23af655bda12ddc15bc78ecaee9c951cf7330
-
Filesize
5.9MB
MD5302493636b2f960388498c19ec3dcd4c
SHA10cd7ac8c2583c50dc17761ebe5e8be6811bcd245
SHA25666010265ea037daac77d89a73099ef5ebefa3469d6d68601bca2ec850d994fa4
SHA512b39e685fbd5b56b75112e8697121b695286e54df858720cd035e4f722346b4ca01e5ef16d2c4756198de97865561562f89ebc178e707904902d286a2e679a687
-
Filesize
5.9MB
MD5b6ddf5b5f606c201813dc279d3333e70
SHA130ad330bc2ab79680496a498e32d6d9a3975a07b
SHA2561e48ee7ac95abc3b8297499b8ea9848d60f88499b83d92ab24de9f397a7920ba
SHA5122b1e21cb00a1c20c6caae124200973dbce6cb20e43e83b3e65d61508ee9546ebbd5039f5d9c069b6c8b6a7993dd470d1d0cb4e2613dfcf85a6b1944318397487
-
Filesize
5.9MB
MD54992fda388cd17d0c2d04b855c8f2083
SHA1e0fb919c8b683a63ae809a3f8b11baf9f32fab7b
SHA25684867ee0bd894d0fe14ef48f126df3a6f75976a71a87ea7a64336729a05752c2
SHA5122069d256428a278ef516b57f4dbb663a7dec6f4f919d71ef7101b141f80adb5507cf39641956fe7d7577f4516b3d69ecb5df8f2d8d843e617818f2b0b440bd69
-
Filesize
5.9MB
MD5d6a6d17d36f5ba3bbf3ffa0e106c3a80
SHA19243f050b834ff7763ed459e4e26bb7ddfed6013
SHA256be1935ddf6da304325fc0d7e8815b3e28439caa4791db22e7fb35aa18c7195d7
SHA512c3f6764f78a74647b36ce5e0f4e67c1712e03817ada58d2ce8f8aacf57c24296187db6094ffc53b0b1e4d8460b567b34c33b1415b748365d96805eae40dd6411
-
Filesize
5.9MB
MD59b9b4ee7899a2d40e416f9ff044efe52
SHA1a5c8051db06e2e9919f665c4c78285fee7981a60
SHA256bd7af1021e6f96ddf03f8b5e2ee70cb0f0eb595d45af2389a6bd9ecb7976290d
SHA512211da5ef614eca0c813decabc04939bb9da9d804fc928561f364815612bcede5e5b4cce6edcbf563dae46c5da43a8bafbaceada19a97ad60517e1e830b32a091
-
Filesize
5.9MB
MD53a36b372f8f0acdc7e31625b655ec023
SHA1fafab9d8afc19c7666699cc928778aa8cfd4ab59
SHA2560c2178de3f2402e121c94c13b91a2906a3e7bc5083cd77d4024f2bd91abc21df
SHA512d167643276cc98ade13bb58efcdfaa458a5b655dc3ef96b5db8f5b6794f9c2c3a83ee7c2a44df1aa06adbd62a23ff9795e59d40a9901ffe01ebe848d31f914df
-
Filesize
5.9MB
MD551c94a91750325844eb91c27e4f20af4
SHA1f04c05598b6ddb8ce1580360ba3ebcfb80124232
SHA25696d601e895309c5090d675c71bb7b0c0aa65d0077e5038cede97617fca2431a4
SHA51248da0ec748ce611348193d4cdf6a8f65010237ff9c6da4eadd1af0461c2d3ca8052e55631a6dfacceda49fe49cb01db1b83d89e9596d6c540df6f1fffea11044
-
Filesize
5.9MB
MD5abadf85ecee80cdb7c8679f5239457ba
SHA11dd42dcf1430ba3ab056fa7ca0a155bcba7a0b51
SHA256f71f6c131b3999b08fb8bccb19b89c263157b5c5cd88797e46ef8d241600d84e
SHA512211c52d47c0604b04d2750946cca366a81d029b5a3dd896592b22b2d5d4f7bcb3c8f84e7eeb249a2b0ee7b25ec063793bd2c0f30518f0c61006b79f7fc0ce414
-
Filesize
5.9MB
MD5290cec67f193dff2a94be070e61411fb
SHA19568cffc35232cd2a48ce09d3092e765efb67dc8
SHA2562543fab53d55d8517b36cccf71eca6e02d3cf5381acbcd65b9cb1cbf0ab26a92
SHA51205a500af594e0d97bfd359ef0e2beee1f59c8b58ef6315b4f9ba060f5359637ac55781f84e6c79b31f88f11d219880589d9d9511b3c75457b86e5e9ff50f034b
-
Filesize
5.9MB
MD53458dbfe23dfa330c4ecbcbd847de824
SHA13719935ceaa0383b81d3c64061b80760dbd90227
SHA2564492d2726e8039b365bf75563aafd26a439e636f6cb32ed22f63d25a087b77ee
SHA512c05166ae201bdde4524be9e29547853f0997dc167b0b49c2bdb120c7db06d363a106a3b173c7f3c64ea8a9c1cd83cc3b92524e73815f5a26f5ddae9f45b7316b
-
Filesize
5.9MB
MD5d0311d436397cd23e5cfb8a90bafd77e
SHA13ee9fc153f92a5e10a8791246fc6be8b338a4305
SHA25614abf2ded69d98075defd251f7a32de160d0ba598566747ba5d20693655c8928
SHA51256e5c303f75bf27bb9efb8ec41f349f2917f51ede0f5c833b81d5cb43e62e8609e0330e6a4cb4bd19d6ff05503d9a24cddeb2b732df04d2fb36850ef8332c4a7
-
Filesize
5.9MB
MD5795bf78e137e169a68de067d943c4478
SHA1eeda8b0ffff49609ce197cdf8f4159e50789ee7e
SHA2562fdeb31c1a01dcfdf697a87c5231b69efce594fae17a8a56fe6bbb7c593d7ac5
SHA512203eeca809c3e63b712a3d602fbcade7217eb47d0fe4fd331344e8361819c9637d05b25291acbc374a9af484a2c1048a72b4c73913d2691ad900a0af0557b1dc
-
Filesize
5.9MB
MD5d3ac2f04577a6aacbd1691ec7eb14fc8
SHA142990e0c695aa4c5da4e207639830d4571465bf8
SHA2563107cc7d49958db696d0dcc86cae024725761c5aa83267ac9c3a1b933b536f94
SHA5127874e9134304476537b983b24b0fa3aca3d7c066e6aea70ba9f3b8834ec4294f388fdb55b3d50062de8eddf215f2bab880f7e1a5864df6656edd5c3389833dbf
-
Filesize
5.9MB
MD536348abc3cae7ca98db73a4e56226082
SHA1bd0f37766dfbb7d16ae5c85dd680609dcc17731c
SHA256d66c5193bf03bf41eda3315f490d13fec68c220571f0a7ccaa727ffe906e782b
SHA51205e7f9bf78fa060a2db87584565f3189ed8ed5f807f95ddba6df4ce6c45df1f86d23dd8371400cf1c431706a3659eda0b55798f4bcea7bf23c41ed62070be527
-
Filesize
5.9MB
MD59b7b86f316fc3d6075e4a93c598ee1c4
SHA1309ac1646d701bcf4ca22a25c775e740ed6e9a5a
SHA2564dee98e26b98fb0d611c30bbc9caeb508c8d9e9a74f7f1ea0fdc00740c799082
SHA51288dc309330e6a7663102e99ff327b6c228086825fd56be048d2a18d704de759a7aa4990e6ac1f14dbe141f2c9330ada777ea926d8b9b43e22534ec00b1948fb2
-
Filesize
5.9MB
MD5dfb9dfb8cd407f72684136a2be9f99f5
SHA161487f76de51b52d41c402b76e1807144d167bf0
SHA256c7e1554e75a899d3f4f39e83045de3af2a459d14e71c35c8a0ddc7a524047e91
SHA512cb04779bf09e73719f9a909c8d93f07e8dd25a65a30ed2c971864125183dd7cc679ea2e587a5c298075cfe13e7374d0a7a703aca1468bc8f75e791efb7b4ff0d
-
Filesize
5.9MB
MD56679ba76117ca6529a7c8f848b99b495
SHA18dad2606aaca73b51b77f78b9ce0944bd87151f6
SHA256a37f7348d690a531082efdcaf3772d351cb7f44a9ad0fcae8ba84e218c6c22df
SHA5126e932e11bda5257fe9eb9fe63a7c6b74d6b3ac8875173aaf2bf1507592ac01eb7cb9e6714688d58aeb4c7ed4ada20585f767baeb397707049122a96cc7010a57
-
Filesize
5.9MB
MD5c5a05e67869a22de8a83da557ae42964
SHA183ae1019e0957d173649b2316667b3376071594f
SHA256ab3dbd64ffb3a065c09fc1a3741dc4ff2f12d1f5282c4f4352a3e590769088ba
SHA512dfeee6e13e57a78f50e43dd6dc24d2d5d639f8feec710f9452cbdcb3b18781099c9893218d2f815b24f7540c9372a43815d95c94bc35de422a5e4d480f1f765a
-
Filesize
5.9MB
MD508c939029740a0df2823a1861ff5765f
SHA1b1ea7ebfe8c9949e8e84fbee767fee619c23bc8a
SHA256919f6440ad8c4104891f88eb444d4f09ea4194f2d8476528187928a057722af1
SHA5128f4256b5b393a480f49d16a978c293a263d46939e567ece8c8bec88bb386a3be86d8bc6fbcc18240072e0b1b4b50c7c124af76e9fe86b6175536e4c981353933
-
Filesize
5.9MB
MD5b447636d2936aaf70b1553c1bccfd0de
SHA13e09021f9dceaa4863c6b9352af6f71c9af54218
SHA256f782514aff9838ee4de2d7e8fc7af9563de31f26fc224a13e0a46ceeab5ecce4
SHA512d195e8ca824ec6e5debea4e10d365767b91235e176833ec2745676ee975e4d06f02bc379b197021e6d7b9885172ea658d25f6fca615d4e6d94fce67d822ae9f8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB