Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/05/2024, 07:27
General
-
Target
2024-05-29_8a776fe5b6c4b43c807c56d055c6a089_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
8a776fe5b6c4b43c807c56d055c6a089
-
SHA1
49e59cce2e7f90dcb1e57cebd2016756fa8a578a
-
SHA256
fd49ad1971cc66df57875c8dcee2f985287e3b622242e5c2ea11b02421ae85da
-
SHA512
7709954258089181d2dcba70f4b36f046ccf4dfdf70b163e8ccb222a136e741df24e1a4962196c7275cdfbb5c571627a9056b0ef056b8a8b4bf466e81c6ae0cd
-
SSDEEP
49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibC56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_8a776fe5b6c4b43c807c56d055c6a089_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_8a776fe5b6c4b43c807c56d055c6a089_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\poCuvQg.exeC:\Windows\System\poCuvQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDDyoCA.exeC:\Windows\System\uDDyoCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WnyasXj.exeC:\Windows\System\WnyasXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmaKsUs.exeC:\Windows\System\hmaKsUs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agnpHZv.exeC:\Windows\System\agnpHZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DXGbtXK.exeC:\Windows\System\DXGbtXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoNXRSU.exeC:\Windows\System\qoNXRSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iAotjzr.exeC:\Windows\System\iAotjzr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUZupqj.exeC:\Windows\System\xUZupqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TAfmHAb.exeC:\Windows\System\TAfmHAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RnGqQjQ.exeC:\Windows\System\RnGqQjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uZTtsBg.exeC:\Windows\System\uZTtsBg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOzvDEM.exeC:\Windows\System\QOzvDEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMJfnxG.exeC:\Windows\System\LMJfnxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmabRwu.exeC:\Windows\System\bmabRwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZYSxvu.exeC:\Windows\System\JZYSxvu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EDJKlsU.exeC:\Windows\System\EDJKlsU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMDvBEN.exeC:\Windows\System\PMDvBEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjxORXJ.exeC:\Windows\System\tjxORXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uAdSanI.exeC:\Windows\System\uAdSanI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjFFpDg.exeC:\Windows\System\SjFFpDg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50cea653b4816b69c8756a37599d386c7
SHA1d05f15302bf78db24960bb3156c96cebad7ce0dd
SHA256d053c61389e0e5404ad7c6e5bf46dda6466540a7d9cea20a1b3f00eb00f1806a
SHA51254d83446237f73355638f9a0ef8b854c38e3b80a009a995d95dd1c4c4a465e52e9aec7adae4fcb224ea09c7c829cdecfd4bd65fe89ed5c991fa4c675e1f942fd
-
Filesize
5.2MB
MD5148e3fe51d9777819ffb9bf337b3d859
SHA129a415e0e2d8c28534e13a62b65411691ef112cf
SHA256764add5800d56773e80e8c8185cd4722cd40c40a9fb246835bf198c4ae0ab4a1
SHA512c366ac7973393f5ff8111ab982d6b3027e9ba912ff977586cbdba324142c9b097550c25f7bd88cdd516e3ed1db5a7b5a51526fa241b08430dde9ad023dc6836c
-
Filesize
5.2MB
MD5f95d32202ea565b23f2daa0560bbbf80
SHA1517e62fe6decdde9fd86d40e5133a415c8388fe2
SHA256a75677003cbe1391256b939bf09a2be5f0479c237a9335d5583a41b477d18a69
SHA512ebd2043b9e160660eb93def09af62ab92004141ccf5ab42e413c5bb6f3e3e708b27fa39eb30005a58fca449fab1b7749d51b4f17bdfeb57270d2eed0f8c61a9e
-
Filesize
5.2MB
MD51ca5092d29c1722f09c7fde4ff474d7b
SHA1ba0ab65b6a3cca5b2c23e20526723d6124b5921b
SHA2568b6627ba3a4d44a84d41ad756cfca5d0062480f623fe0e0dd465aca2ac24b1fb
SHA51265009ccb433b1b63f20dc350dd743800b13f821cc39d1ac11fa39557d174820a729b2960b856405e0c992d46f2a1f06f7260bc224ba43118754c965a62048270
-
Filesize
5.2MB
MD5af2835bc7761d6ae54cee597154ddd2f
SHA1c07830c72f8669bc5e2f2a78ca7c8ee89876159a
SHA256b1784afc1ac03f902039b6ed1d204de256be07f1344941e0b7e5f13b117a387c
SHA512181489e5a76aa5581619d2a66db3a4285fa955a8d22d20ed2dc5c56b5315eb9345239148924c3eaa81f9495728a6b36c7e7bc5be82a4096db424b8bdd71428e3
-
Filesize
5.2MB
MD5bb17f718494d55885fb87fe30eadd01a
SHA1368931ad9ca53a0d3ac95dfbb88c3b58f7b7823f
SHA256f33e92bc899dafce677ca21a14fd98bb3ccc83dc7a460725bff2116b765ae0c9
SHA512864e55182266b77968f6ec3b24d68cebc9f5206fe2ea92bd52ef0b8ab7818353c9baa7702c8b3f4cb8ffb9f27412e212dd8495406cf643d7d3eebd3f87fcee87
-
Filesize
5.2MB
MD52a89dba612cd634c76860b8ca1e8b505
SHA16f0631a77ddf0592c1a1a4b851275e2f4563b511
SHA2560f526042bd2ca0957e6b377f6d33978ae0c2761d45a2a3c330c7a6b2bbdf6edb
SHA512f3ab67a44b87193ff43e7201b68c2ffcf3abbfbff4488c448a83abd2a937e649632ce36ceb98d304ca8093926b5023a57949939d8b719348b66b12ff7dffbd90
-
Filesize
5.2MB
MD521cf3a5257ff299bdf71af6490e6cb9e
SHA1e5eb10d3381ef6cb229dd4e5021937afaee131df
SHA2564d8577ff7bf6502b7b2eea2ffd3beed928647f7d9235f38cd07d5f5dcfc479f0
SHA5128d10882b05ad9cf570ed6c4e82d4a9b95caca1ed18ad2d2c370341d2065045f795a43afef24d37f168d70eb334ab5cb95d88ea9df39d3ee26e5bf577dd4002bf
-
Filesize
5.2MB
MD5d8d8fd7f2d9ecae457625d04c03c120c
SHA1cf5c6e91dd9fa93680929593588899cb9718bfa4
SHA2567af79e41d7d9b32a7408625cd4b3a520d5d3e99efe96f1d96ff5795dd978e3ee
SHA5123334eefbab35f34b80f61f72971136694fda967c2f74d1cef08e4d4abb9fa97d1bddbf5b1f35bbf64c1436fcd73ae0d6c37b849f4162b0005ca5adc956f8a7fb
-
Filesize
5.2MB
MD5ef114524535d0f7f9f9b9e760fc34b85
SHA16af96423d126422c3b60ae91157a3b77f9e4ffda
SHA2566965750d56c0c7d3bfbe20b95733608a2363f2a41fca5a8bf006237fd812f11b
SHA5129b7dee3e9db39cfc1f3e4db7e523c695b40428878950fe2d57fb54701eb55b9a17509e88b3d5c5ed82d8cd3eded5ed8c3d803262edf68738465edd18d464487b
-
Filesize
5.2MB
MD547a2139afe3777af26b9ff77a75ebc28
SHA143505c28ebb5a850bf1007edefd5254a4ea55c6a
SHA256cfe07a7825be141b3d75e647d6eb30aeeb77fd97071ad998e82a2085f7a0e55b
SHA5128e27472278d4dea117833e69e87fbad14f4995c2c05340e93ab272cbdf1d3ce494a1a1898014a6acc62d979959d1e228c7ac4d2bab589490fc9bb0695ed4a8ca
-
Filesize
5.2MB
MD54192f1c380af72539d917dbcf6e33b75
SHA176840b4749a588a5c286cc772c1ac65b9fea1a48
SHA25628b25d3322eb7fa28eeae914bfbf1c9f3bbc22db4f411f53cfb18f30146e7c43
SHA5124327ad212df65255ae35c93bdf76c946ade4699f6ddfa85a0d2b915d5b8d323e63eae92236e943423da91749aaeed8df689e36aaa50c829783d7603a2736468b
-
Filesize
5.2MB
MD57958ea65804bcc6de2c94c162cfcbff6
SHA12169992f07b642709b8f714be956a809b96f7fa7
SHA2564cf96d325e1e148fee2acf10306287683558485d8502ca3f7e94322243b5012a
SHA512179b8761b71094eed0d1fa26592a05889cae7e0b43e81312a701730e3a2c8d4469c2886d91695a30b176e60e8a6e1b9a624fb601f4bd1b703ba2dbb008a4ca82
-
Filesize
5.2MB
MD5a0b7ce93b0d97d72ddeb5f2715369fef
SHA160fa6c137a551855f0188f88721b98c2c461df5e
SHA25685708c5ae4f2a01fe3b7b573ec5aea43e99dd72943c32711ea831c40ff717e7d
SHA51249cbe7120f42b6394efa00c3353acb10c4bf0878f9a26a29ad2958a44ebffe9688dc6ae7325f9bc2ca95e112e929c3c9a5a57768d82b7df087c9c076d4495255
-
Filesize
5.2MB
MD5bf901ae074bacddc2ff13ccc34487e66
SHA1319b86a20222447da7f8fd8548db0d9a08e5a5a3
SHA256fe4c32ce949dad36e38442bfa621cff3d09f4787bfdd7346d6b4016f3e9c6485
SHA51278aa1fb7fd1d95fb1475d4646a97056e10d64ab7ac14792f8fd30299f54e8333b5a0ed0ce6a59118260d1c44f305d0bd675f97d48f3eff2db8296eb359b72ff0
-
Filesize
5.2MB
MD5d97c156860fd59278c6d3fe9ee39d88c
SHA1a6fb4b52e48cc05f38b9ccbc708d81adce0cb34c
SHA2562c3c9ac39e0fd6350dcb2eb31d497b4f099f399eb9926f33ee3c8477e89609de
SHA5125aa9b05aa38b7f3abc041e7d090b56f3e8c704e038028e3eac597337274be8f38c9680bfe4721122d47a06a419472dd5738f60e803fdcda1c3f6c162cd1b3ffa
-
Filesize
5.2MB
MD52874d7971a350def6b8bcc7f52f0a582
SHA1ddfed46bb8f07b11be7659950ab6899971d8b5fe
SHA256c77c8b1439b215c6765f3856970cba4c06016b26fe4015a9c0af702b0b257c95
SHA512be0c036231b8abcf6e54562c26420a11fcc9619e7312fb4ebec7bc93cf338540f93ed7a74fd9dae0bbdb1442a82be38585110fa8600be79dfeb957d995d61915
-
Filesize
5.2MB
MD54eb26bec5f0dc63a310fa196212efb3d
SHA1e1f311af2c63695ea33392fceb6752adc13b3141
SHA256accdd6f558a0d5aab80011de8a69a4393f87969dec5b1e6571a47da7ce526efe
SHA512422d282940440a03f3617c9dc58e343a3a7e7817f146a7eba94e824600d853bcd15a60193187271e28bc0f49270e1b944c75f506df0f0fe4c1654ac0d5e5170d
-
Filesize
5.2MB
MD54dee8963d6e53bb728bac31295cc2b7a
SHA13578003c2d4c8f5d3280dd74f006c9fda6e6534c
SHA256b45e4694061279a672d8d5704e75cb4f177e11f15024a2fa4a6471731537626d
SHA512d4b7011b284b1837cf0eb2f53e003b0453e3c542181a738967589cda3c5b6911c98a14965e0c1c64f9bfdb71e35bf0b1afd1189032541cfff8d9c559f0b11524
-
Filesize
5.2MB
MD5b1720a3c06cde7e0ad12aa2a4e08ce10
SHA1e6b58a932e52f47ec20596c93543c9d625be7a5b
SHA25602dcfae9b53898f3da3bdadea0d7f9388c0f1ece81e2db76e855ef5b44208ab6
SHA512afbda83689269e9a649557bf9d03ca94fdb522a5eef7de99f3c59915fbd86d2335a7c348c729ff00bbd101014ba31f00470ea9b58d07b84132db137acee81c4a
-
Filesize
5.2MB
MD53ada059bbe43e177ea990f7fd700b5ac
SHA1f65e8196679ed602f847a0152d25787d177ac941
SHA256427b107aeff0b1915b0103b5389beadb62f8ebed46bdea1255a2ba6f67040d40
SHA5125cfeebcf1320e9133dabd2ba4307fee7e5e08375725e521e4790133d1128d77a24730bc486c833bed63e9c91366b94c72636c9cf1fda0b7261dbcc3b621f88a0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB