Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
28-05-2024 18:35
General
-
Target
2024-05-28_e3ccc407b8d6b9ee94206b7767540ad2_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
e3ccc407b8d6b9ee94206b7767540ad2
-
SHA1
cead53f14776a44ab20ddab832d6269469d0b321
-
SHA256
a65d85db75c55db0e7df50a56374f921226cf9a633c9c9660d64c04eb389e894
-
SHA512
f760a936a8c9840fd27dfc82eab161a734fb7ff1c5d6c417bdb130e0d9d5118a137d5660a3ff474d354db1354f3e77e9ea893a54d33bc17deb5bba9d50920208
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 61 IoCs
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_e3ccc407b8d6b9ee94206b7767540ad2_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_e3ccc407b8d6b9ee94206b7767540ad2_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OyzxRNc.exeC:\Windows\System\OyzxRNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGuQrKm.exeC:\Windows\System\nGuQrKm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEBMydk.exeC:\Windows\System\QEBMydk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXaDfJt.exeC:\Windows\System\BXaDfJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djmtiPx.exeC:\Windows\System\djmtiPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DooAUau.exeC:\Windows\System\DooAUau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEZVoRu.exeC:\Windows\System\FEZVoRu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nExCktC.exeC:\Windows\System\nExCktC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOoDOZA.exeC:\Windows\System\iOoDOZA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmvfYbW.exeC:\Windows\System\mmvfYbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFhRBxy.exeC:\Windows\System\MFhRBxy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKVAzUj.exeC:\Windows\System\fKVAzUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tEPpIkk.exeC:\Windows\System\tEPpIkk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LTWMJZY.exeC:\Windows\System\LTWMJZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAODcQv.exeC:\Windows\System\mAODcQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uwgqsgr.exeC:\Windows\System\uwgqsgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHkKNca.exeC:\Windows\System\BHkKNca.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQkjfwI.exeC:\Windows\System\KQkjfwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QupBMCl.exeC:\Windows\System\QupBMCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yokyPdY.exeC:\Windows\System\yokyPdY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIHdwIq.exeC:\Windows\System\iIHdwIq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53ad7bec44a175ea5f1155ea53bb8ce39
SHA12dafc919866004e59709c55da8dd5dc838b37f97
SHA256330df279819108f01bccc34fa5c50719f46b9f21b95b49c04e1423b933f8bd93
SHA512704b11bb12107eb16ff9e6b52abb4656c9cad03c45ee15fbd19cb73d99afd7be9fcc2076fb049f0eee79d28391dc6277a1986bc61585461cac536411c886434f
-
Filesize
5.9MB
MD54f4a6d001eedee97ad496ea3b9d493be
SHA1ebba520fea93394821154944017cc179d3abceab
SHA2564456d98cd22af73867d48f6e18de6fb09ab613784830cceadc204cfcf344a76c
SHA512d4a4d103e39c6c05f36e4138bff9de530c89077094ada01ad2ed891c7aee82c3da69b327212e5bbb3380bb069088a283201933b61cf6eab9d66d07f45131e3a7
-
Filesize
5.9MB
MD5f49766d4d65dd49a7f05b94d577f569e
SHA15c0c2b1e006118dc9e4a791425544166ee67b087
SHA2562ce8e5936b58f7243f05eed669029f0c3cc75c5fc040bc547fc811768eaaf2fa
SHA512def18ab2f38d1eef79c4047feb2839ec7b7f808e6003aad2f8b4b81ba07ef641a0ee25770506001b8adec995c8a6851775bccf1adf95d82d0b83ec364914ddc9
-
Filesize
5.9MB
MD5917c96589a95f1057766b2c235d3b768
SHA1822abb6cd9e5149b822d165c8c9f2e51c4d9b64d
SHA2561408b0ff439912cff3592be745aecde63749f84829167ad763fd6814f3c83aff
SHA5127d36dcccf2443784b254526c7a7afef24ab775d606e62e6ae265be7ff39f027a8d25453b52aea8f4df9ee5032a6f83feffbc49b15deb0e913432c2f68a0bf69a
-
Filesize
5.9MB
MD5a9c57e78d5afd606bb9aa6df36e905b6
SHA1d2f16409e7c43808be2161c9a34e2d4910af84f3
SHA25605ac19d50b84d78c6e5ec650cd53d6cad9ff1401fe4faf5182ecbbaccf4becf0
SHA512d7de81b204a0cd65ae8ff5636efb0931cf9185c1d77970d8eb6472714c0f01d4b7aaa73e5159136d4b6efd8f414ca68d64f2308db717dd84d7756bc3607bca9d
-
Filesize
5.9MB
MD550a62d0545da0e48c81e27510fa86f5d
SHA14de1ae5f04994c441ee7ce747db62c1edfd472ec
SHA2563e98cc2977fda22ad9a4f62161988f758c484e5cccda6e2655e86660f195e3de
SHA51287198b6eb8260499eaff9cc0151e274aa7ac530032a714fc1ee33ccaff1dc5b4c441d09349c9db8578a0c979566952e5ad2326613832319ba0bbb63eddadd121
-
Filesize
5.9MB
MD55f16ec46383a7c9eea7d7a32a20e1ac6
SHA177d34c88fdb48ce72eeda88ab78a9b5bedf9aa9f
SHA256324692e48ca6d5785b8a3074eb72cca9a1fc77f7989e48c24081c6c4383ef43c
SHA51257e9f36281b74bc6ca642edfe341d55a6256a84318ec083c4e2d83d25b3a234c41ea47a5af2cfc6285825d982031a7eb73add99fbeaa62c153749e901b15069c
-
Filesize
5.9MB
MD54e0f1453d40e441f03182b386728c6e2
SHA1ffb6ecf5dee3412040e3a0e9262ce353f8a11431
SHA2560b3350c9ec4ef85bfbc4b5f6c1b045057c16f1b745ab637af58804d5e0240d81
SHA512acc88f297bc3000e05e8cf5b9bbd663b488962d4e5b2d812cc6436b18f98901a44dfcbb9b01fd0995d2aea92753c3a2848aa135bca4dd7fa56f27cb5acdf8c68
-
Filesize
5.9MB
MD535f74ea335efc9049a9ecebf14033ac6
SHA11dd539f837c200f513bee8fb75cb42868ddb29df
SHA25618bba7db8840f13283bf92490f1f69b30417cf8b377aef743ac9854ffd883986
SHA512f775599bcf6ceff3870ccd031cb9dbd0520230a5ba847ed20dec90d253741eb8e1509e70d777ab27af442df79a76150282006bfccca89ff9ee465a03a4f3ed58
-
Filesize
5.9MB
MD5231f4f49915a9f8c1a04984a12cda997
SHA1c37919e3f862bfa58b54b2d1154162b488a3e02b
SHA2569c1117c616e56443b40e1f20d09e8099f24c74824d89697cac6f6911a5468929
SHA512fc8e5287de7697fab3f7e57c12249ed2161a7d066dcbca5b66e19b3245c55cbfd23c76105e344530d8b84a5b72004495b9313fbea2a0ceb3ec450caad6f0891b
-
Filesize
5.9MB
MD5640146c84ad9fa14be5caf09d469e991
SHA14e1c2eb94abe4b3500cfa0bd277b29c9427cdad8
SHA256bb8765bcd255c16ca1373d5e4d3c3c6155a63c4e67b1adeeb4274baea36c5f77
SHA512d30b7e5667c1993229279d3023eba0db9a754eb0543d834063c248b6969c0080c5e5599e476d52ccdbeeb44dceaad22be44fb1eaab1b9af22f7e0dc707657d3d
-
Filesize
5.9MB
MD55d36efe124535a7c0124e5e47fd739db
SHA1954376e5ac382f7b73423408f4362d07ab6bf343
SHA2562d70da1b07cbacdf67d09875b18c6d71c22bc3ec0fcd5cc466cc43a441b28d9c
SHA51242ff560ee4a80eccb52f7e92ebef1768c62d32133cba0bd152f9b8764c0be8e17dc713641d22ab317623ba8750ea3d025f08009a298a9276f5d4b0665a68effb
-
Filesize
5.9MB
MD557de3780ba44670a067d03450b443f8b
SHA17ce0e01617ee6e0fe76dc6daa1002d19f81eec02
SHA2565a487018299a9a7de9e2e67b256afb21dfc7804139d1b37cf6e38ca152b95113
SHA512d9cd84a8cfdc54fd50d4f2af163157023ad1bb39d2a525248f1cf356b5de01df940d2a2cce1c1382d86ea1ecda2702c6828f39765b57b4a21cc22fa65555ef3f
-
Filesize
5.9MB
MD5451a622ec4a3616dc1e7cd375815d8ff
SHA195fb38a52c985145043b3ba9919efe1899ee99df
SHA25671ab259c760c5381b1aa416e3321292c8670d218bffe737837a1bebaec473d91
SHA512851be1a71d4ff0b483d7064ea18c8f9225c1921700a4e799ee4e61939c65f5df897f76b3eaa363216bc46319b73968039b0c026c7a0bc0d05bc65ba2b6a00971
-
Filesize
5.9MB
MD5159571de7614e80ef5608ceb754c1a88
SHA1e71fb0f803f9318aa1abe3ac435ac3660c271be8
SHA256e7c98cc957ac9d243e0acc6477f62e7dc01f043a41fa26a56e6b7a2a4428f2a8
SHA51213c84343b9b4bc954c05c301ab00a7c7d58571ed85fabf4addc54a4627432fd57d4b86e3016abe60c9a598b49d419606162a2d0a26d90c8d9a90561e7dbc37cc
-
Filesize
5.9MB
MD5e0f1beff3d5eac29b1242eaf0a65d223
SHA11a1ade074bcb107b479a4ba606349546df6b74bd
SHA25695c5db4ee210c914867f4ba49c64d547f62c9b6971e37480536874fbf433f992
SHA512c789a6e8fc2ad0a56bc74ba795c7afba9461d75492bd1ab1cdd5d1c2a5daf19d148593af1d314709eb653f1a4b4d73baafd20f45662a60af93039e3cca89fd88
-
Filesize
5.9MB
MD5c7a308575657d129f8a7af3ac6f4a721
SHA1af760863fa6be89069a7bc1bec45d38db75448e8
SHA2564956f46275f8195ef5ecfb1900616b083db1dcf452c9815da67ee246c03256e7
SHA5125755b6374754bae638da39e1c9407b8fe6877cdd8498829fe9c131724ec7fa8d275e112f8393f92e94853cddb3353a2cbac2a5f725f57a0066c3b3672b70508d
-
Filesize
5.9MB
MD583496ac8212f0e33ed5e241fc248be22
SHA11c2a706edf1cd499a01c171f1ef4b805a8d94884
SHA256135d48eb991054916f17edae2f8e287895cefe09036bdd18fa6b59fce6b4bfe3
SHA512bc43e1f2195fae0a9ec1b97bb1348e3615c5eb945bef472a25fd9d4d3b5f0c550a67558b49aa12a561735a8810c9579af5000c1760baeec08f59f0881ed16b60
-
Filesize
5.9MB
MD58987adfa0703adcc87b69da2e5d3468d
SHA1ccbf95af5fe86356b9cd1d0f08debfd7fe8a9f70
SHA25638502a786aa23b21964ca209d1ce5e715164fec4f4c5f3d365aca1d780d2f6cb
SHA51282b51d6c9d333effcab597ce6382c1fc58215e46d22da183f57252142b9b3dc51e6482b4a493b91398c1a33ba23335f87fbe3cec9c6edae9d8155a4392994680
-
Filesize
5.9MB
MD5279c436e108ac2baf8037fd18adaaf18
SHA1db0ef425a3c735dc34c564c82f8a5a6ac534c538
SHA2560860f631d9e68a326997c732900061de42a8630e54e8d831bb61be404970b922
SHA5126085f71744482057517968b8fc2f1982c80ba477f6cff39f403c3df3d112c35435a6d7ba742c1dddcbc248d94dd6abed79e7b3745aa0689dc8bfebb6b6ad50df
-
Filesize
5.9MB
MD51a3a885f7174114757ad408b64f72734
SHA1ebcfac8c03e5cfd7483cdbe31fe13e47d696ccd6
SHA256743d144fb8a622e1a2ca456d0a2b7d39f535c32133a483c03d8d95f571a21dc4
SHA5125620124f3438de3ccaac7f9adb55a25da8b7823c75056e59b7c623b3496d783600c698db9f299ecdeadeddb010c13d312969f24c5dbca26fd3f98c226abf5f72
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB