Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
28/05/2024, 20:19
General
-
Target
2024-05-28_b63fb80e0cd7b724a60bde244d844588_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
b63fb80e0cd7b724a60bde244d844588
-
SHA1
9f2634fc662524b0949bc9e5af7b48683d825966
-
SHA256
e785acd308800530284caacacca75756ad61a4c1efa5b21c431df3aac799ec66
-
SHA512
60f80a743a2777f4bc190caada100d9aeffee45c5c4dbb358b8b27b0576ea73a62fb07b3670c49910909da1fadcd3282dcd27ed4d0d99f579731fee1f344d3a7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 63 IoCs
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_b63fb80e0cd7b724a60bde244d844588_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_b63fb80e0cd7b724a60bde244d844588_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uJQFskA.exeC:\Windows\System\uJQFskA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KEesSub.exeC:\Windows\System\KEesSub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGlLpHH.exeC:\Windows\System\kGlLpHH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CkibRRC.exeC:\Windows\System\CkibRRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYBkGMb.exeC:\Windows\System\dYBkGMb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LOuSzkC.exeC:\Windows\System\LOuSzkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgNzuOV.exeC:\Windows\System\YgNzuOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdZnuUg.exeC:\Windows\System\zdZnuUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nVBuPrR.exeC:\Windows\System\nVBuPrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjDfQLW.exeC:\Windows\System\FjDfQLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXaTuUv.exeC:\Windows\System\YXaTuUv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DJvXNWp.exeC:\Windows\System\DJvXNWp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KngwqMG.exeC:\Windows\System\KngwqMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gfKJVfh.exeC:\Windows\System\gfKJVfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jeVbfkv.exeC:\Windows\System\jeVbfkv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlQADIx.exeC:\Windows\System\ZlQADIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsGsWeR.exeC:\Windows\System\dsGsWeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKttcIc.exeC:\Windows\System\VKttcIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zWuePXp.exeC:\Windows\System\zWuePXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKLXUlZ.exeC:\Windows\System\mKLXUlZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEEwLlq.exeC:\Windows\System\OEEwLlq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dae6b1d8a424790eb457f5cd39d6383e
SHA1bdfb6f442e6cfff359c227169b0b50f8dc15df3d
SHA25605d256f90bb6820d7f0e3cd7fc0374421ee5d7e91d2a4b3c021130370ed7afb5
SHA512e4ce60c7b245b28c431d78cc5b09eb824e4e495393ba296fcf89a8f70bed65a7c8c0758f3d431d597a7c2875214f94f0d473e02af522cb20b396876a4aa847c1
-
Filesize
5.2MB
MD5afc4cdc357e9852fd471620c2863b0b6
SHA1aa804fd9f4b2861c20456055606edcd75456f305
SHA25684485f0267bba1286de54a384cd55a4b6d1057146f8e1bd6db85aa7d9df2a3c7
SHA5122726f9ed4f522b74adeebfa0e301a88ec29b6b7b7e9757b79e559fe3c6e9ee3404c6443ca33ca2312becaf1687451b643f36e8fcca837d6a6f2f45cc5b6806e2
-
Filesize
5.2MB
MD53ad52721c25d08b2d626f24fc50a919a
SHA160fb2d5179456408a9b84c67202a0acf6d68029e
SHA256e27ec8f4718e98946780a54041006b64f617eb92086b8326da009d8ea09dc213
SHA5123a0fd8d01b1f6f4fabb3e7416d92b00a0bc4fec358ca487984227f829535b84effbd04c07426784f1d0f6b2f28197e4bafeafb9d4c6f0fd647c1d1026359e47c
-
Filesize
5.2MB
MD59cd149883835177f15892bc2a4a44d44
SHA1d02aea3835e1bc7f877098354dc0021b9dc09ede
SHA25643f3d5b75bcf89cf3e0f6c40b48a62924e9df1ddcf0333e893e24ec35acf9539
SHA512089840dd27595d437d6da33b2eae4fd9f8e5b45b683748d2515b8cbdb48aedc435d65fc63079287d48fae42457fe45a68d4889d9e041c40b6ad04371280919c6
-
Filesize
5.2MB
MD5f1e7f1a410f171385ac4023394917a59
SHA181ff1a6b000681be81f132e5e067d38f6dfb8630
SHA256ed87038950e243b4491ca85860c34764c73f7efd54468cadd6c69a243ef30a91
SHA512cdf83a56270f35178d946c4defd2b3f48b9994f8157f33496070863ac39519e462a83127d6ec3a6b09fd342b56d1178469a32a0f91bddcc20979e9c1dec026fc
-
Filesize
5.2MB
MD595e5be018a604e2f4499291d6c59427f
SHA116c4c1ecf8396a410bdb9aeb37d4287a07f60350
SHA256593e95563764ac269270a4b10f2d34cea749d1152f271b78d7dd8b2bbc9da67f
SHA51253b4773cc8df08cc6755f866deb4ae4214c7f80d2c5a31ff14a2f216e8fd306729130633716b001eafcfb0a4946d92e472f74508a4ada3e0a38d066102b5400d
-
Filesize
5.2MB
MD5668a38b1615c91c034a7ef58b648e2f1
SHA19c93fad3b87b8c4815eb379fbb6e937ae272b4ef
SHA256943fc84c3432349f95638c6d9c282d971f17b12a1f370926f116942e363d7d1e
SHA512aece82965878a0162792f9bbd01b3ba433b9ed4d90aef619d5b65ecd7d43784dc508258b110fca7216a761647ac80b8fac81e0c6df2ce5208029de665f6b9319
-
Filesize
5.2MB
MD5e8df3388c5c161c2f88da8df9bb5e4f8
SHA1a85064e39d6f194b9754e52b999db08778a80758
SHA2568027c9f2349fb94a152fd1ae9c42e5525db621f7eb6fa8924c4a60c78291c2d5
SHA512683723c3f6d7c1d1a8630170e52a18176c51523cfbed9f20ffa4851bfb2835782cfab2ef2487c5b1ccfe622aec5bf8a2c0533e2bb62d0aec47b97194c96aefdb
-
Filesize
5.2MB
MD52a07d368405121b557bcc59e836ec67f
SHA14b4e9751752e054df7efc6a38982eef07a734c43
SHA25666254297234ecd9e7943fe833b22b3608a5d8b3105a6386f42ea8aa684205438
SHA5121dc680816a8e2fb860f9afcd26c04e825e93848d7becea6c0d483640a75bb7b10f0fbf70a86dca2866a8b70d7fb7c3b5f09eb58501fbfd92a54d6eb26077c63a
-
Filesize
5.2MB
MD5bee64b8a1f54cfd757cb6e4c3be14b87
SHA19e0e5ef7caaff5b2920935dfd37638c4ba4f8002
SHA256e4b02449795a3cb54ed4c49015c114a6d79579d26972ee921e454bc5deea1374
SHA512accb318e580a425b2ffdf9c94832b9c2a1ac1c0da749a45cda73823cbed7cb5d4ce07e492289bddd6c91add07e8db37d38f2892f6cf890b96ab5e9a2cecadbbe
-
Filesize
5.2MB
MD5c437c4872bc470407b87e6acdc542d73
SHA1580433526a13ffe28fab18a983c79a440b668359
SHA25681479f330e3dc0fa70cbbcee08c9e336cec96c66ed20f790f957bcc9635d1080
SHA512c1250f8073b513b40b7cc1b6345dca889d92673d0786696af494f233f116fda0135b6e97b8520a210f7f865b07826418787e7e647ac9ea7e907f73f9eb2c95b4
-
Filesize
5.2MB
MD5a52d92b5faddd90b7f5ba25fc9016347
SHA12b21a236fd3c306239d1cc1faf0231ca20bda33c
SHA2565031a3d13d8c19f037996c633a2d3cf3ec2d5beecb6aadaa72880781c0a2c392
SHA5128af51f8fb3dd1d4afc771b5d971099fc00983e06b52955ffe3059fce7de7a549cdc9c28b15ce17d16f41c3abd90a7f8604f835f99d4765462b91526802c6d950
-
Filesize
5.2MB
MD528b31303a517549edcdd2143e4ae1428
SHA1cb5bc796e7338c69e5ccb1b72b9bd1d352662ae0
SHA256cfcdf45fdc8a09dbabb893656e304ec23abe70b179fd128b45878512ad537582
SHA51251ad82c439f7bd04a6b7efccd0dfcc267562061b25938a00dbcefff40475cfa49852bede2b5591aaaa5072206267f3e6fccf9304fd6fd3991d18342137666666
-
Filesize
5.2MB
MD583a879170810426f878ef81946610319
SHA1ab194b55f4bcfddd48159e8c94d1461b17d30ec0
SHA2565a1e18cce2efe937b1dbebbecfff4a25c9279fdd585eec10777ac4f75018870f
SHA5128c121de93738ef0518ba435e39a1bfb2269dcee1a6e848d03cbe2d74ec41f65704ac4ff188e10adbcd1061ac457d10860e18120993f9183c098d92c4f300ac23
-
Filesize
5.2MB
MD5983edb9b0925128b96d936a0585f8fed
SHA12bb8185d4929648f61a16e90fc1fd7677d6ca624
SHA2560e184fa8ceefc218810c9f5b16877f6266a6781f766f3284afdcec3c55c84746
SHA512f9e8841b5e82092b15a0290942e00d386f5fe3788d5f4fbc03ed8b5a86ed940440bcc9f85fa1f2c0a88c918333ca02806975c0ba3fd27a2955ddeb39229dfd84
-
Filesize
5.2MB
MD59b55fc277558baa56b0f0bd707769e5f
SHA1055d94b975955ba31ce07c27a6c41e890263664d
SHA256cbfab5b67ff28b090a55377b00392c2eb2a00282d7f00751bbf0e963617070bb
SHA51215bf47bdce22b97963801ffd6f3a5d0e5a82338ba1a527783ff783fe132e1b814fca6c2a2de6705a3f6403de06473fe4fb83b608b87cd37bd635c7e0b5e71c05
-
Filesize
5.2MB
MD505f2756b6c490f8286a1e4713d607c5c
SHA17c2d5ec55fa406992b6f5567eed523af315db9b7
SHA2568c4f1581f48dd8b77a9de216478d09079f45b30a043097e46a4f34ec85f24255
SHA5124c6caa0ab3007328d06a305860bdac8dfe849317facb5eecb8992ddeecec4f6ebd1d0a0a9ce3d5751fb0a8275c75473131edaf683395d11ee03fad85a94ba458
-
Filesize
5.2MB
MD53255b23214eeb519e3ed773f8d162a87
SHA15d555ea6c9fec71b3dd043dc25a76309b08e5e0d
SHA2569dc3bea0539c5b6db173721c157415eb70421b894f55bbb1a31534fc90e5e4c1
SHA5125bcfb78cbf1a918ebeb22fa46c9ed7deff42ffb8cfbb8ceaac999c23e10910337c53bd02e668ad8fae932c6f83107f472ff64d892f342f3857f13dbc1eeed3f1
-
Filesize
5.2MB
MD57822df11d541f5b7e69f47609ac0547c
SHA17d4d92e3d9bcf797cffe16ae22c289afe0ed64de
SHA2566f75f1154bdbd58a43f9d5db63332bfdf61ef074156410e31d1c6c7ed9970640
SHA5120a87f4035f3fff22d9fd4e71ee031d6a1fab3b2e5f94e3a84adf5dc5efa00a226ac24825fb9e13856276221897fdb12cc9f26efd9fce06338cddd7574933a2a7
-
Filesize
5.2MB
MD5004071325d0baa9b9737685236217082
SHA1f7b1f2fb8ae29a234918b1d6f62e06dfc077ddd3
SHA2564789b9fc2bd941d7fdc7c9ad78697f36f222cc2192c89d122adfcd5fbb2c62a4
SHA5122802b14a3a2d5aee86bf0f8169281c34a6544632a5436bd7c0f1c30922813cc9700105654c7a31da646ad8c52ef16fc830936548c536cc871910118e63b71caa
-
Filesize
5.2MB
MD5b6358012b7bfbfac027c926a9c0b431b
SHA1bd681a4fb9749e62add99e073d88d76a9cb01f6d
SHA2566e7163e35cf8a8497e9a9b0ac340a13a7c318f823c324ade195b5ae566f182cc
SHA512864c09ea23e7175ae69770e7961220142cee689ec56e3c85c5c7bc3db5a1d1a0bef472ce1fd58615081f6b161a2e1bbb836a74e7333f486a3be5de606fcbf57e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB