Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29-05-2024 09:04
General
-
Target
2024-05-29_6bc4bb3ff20e2b7eb5e8d96f1f7d4558_cobalt-strike_cobaltstrike.exe
-
Size
8.3MB
-
MD5
6bc4bb3ff20e2b7eb5e8d96f1f7d4558
-
SHA1
1e704db1cf05e777e075104032bef4a5e3f829ea
-
SHA256
b1253867c8c0a4c8c6ff50cf756298d6e0ffce9ef427648b429446252e167cd4
-
SHA512
99015e2b0be40965e6a5ae57440c6b5cfc8856fc18b16a3f8a534f6300e28d2a1b8113a919aac98600dad044a8f38ff20a1b15032cbd65c06ebcac17f6178c86
-
SSDEEP
98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUL:v+A56utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_6bc4bb3ff20e2b7eb5e8d96f1f7d4558_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_6bc4bb3ff20e2b7eb5e8d96f1f7d4558_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HEStvjA.exeC:\Windows\System\HEStvjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unHLASo.exeC:\Windows\System\unHLASo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXgKxgE.exeC:\Windows\System\hXgKxgE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bqgBnhf.exeC:\Windows\System\bqgBnhf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ngrXPtk.exeC:\Windows\System\ngrXPtk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBtTdYN.exeC:\Windows\System\aBtTdYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSgoReh.exeC:\Windows\System\HSgoReh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TAfHwEG.exeC:\Windows\System\TAfHwEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZoEZyS.exeC:\Windows\System\yZoEZyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnCxDGn.exeC:\Windows\System\QnCxDGn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AyYKMoZ.exeC:\Windows\System\AyYKMoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbTxPOB.exeC:\Windows\System\YbTxPOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfBJuwp.exeC:\Windows\System\hfBJuwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PolFnqg.exeC:\Windows\System\PolFnqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUCQAJG.exeC:\Windows\System\iUCQAJG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxAQuwT.exeC:\Windows\System\yxAQuwT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mozTkaE.exeC:\Windows\System\mozTkaE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNigFGV.exeC:\Windows\System\DNigFGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pelCthM.exeC:\Windows\System\pelCthM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nVYaXYj.exeC:\Windows\System\nVYaXYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJEDkiA.exeC:\Windows\System\hJEDkiA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD5450cbfa90c160bcc0b5b466a526a0d4d
SHA15669e5c95daf00d31cfed16aad07bd140fc1736f
SHA256e297c5d2d6845bf27126c8972cdec36c5160afad070d6c452083cde2d98871fd
SHA512f483a3e08e036788bb6033bf569ff7b9cc633306886fe8d223885bfd403b81f1d253a4091cd67411ec98e47e0503336d2f442dc37c717fd530f9842423c77a52
-
Filesize
8.3MB
MD509cf79bea8166a56a2ccec180ee56dbd
SHA1bdec3b5c2ad2f5eef4f65d110763d4b0ec2c63e0
SHA2567b6d03a92099c694cb4388a2528f3b5c8c2426d3f6ca39df5265251355112245
SHA51284310ba818bd1210b6f91c7c7d7b185bce652e443e39bd7613d704b6ef651843ccfcc33839352c4350772482d31cefe45f1e6f81ee09735c7784f3a586bf3293
-
Filesize
8.3MB
MD5b496ada48f0dbdc57cbfedb1f200d645
SHA1566598476a3c2dfea6683e74f21b335a0b3f1cc4
SHA256e649b726ab2fc1396fcb154795eaa766bf210d1c560044618a9916cba0e7f890
SHA512594f263337bb2562920d9c377ac7874c569222b8750f45bee848aa487b248d64089f395b650388a972726e18600a6ab8f6ab61b90f738e1cbba74c969847ff65
-
Filesize
8.3MB
MD50b4a78513b2b0c215d9d0114d522a823
SHA1d96a350add16ad4f87277a2e55870d2d2f54633a
SHA2564b8600fad83871c842fb007b503484e387b4ee01bb39187ccc4f34e3ada1ead0
SHA512992a5c1f8cb8aeac6d0fe937db85c5891c4f205d98537dcb90d2ed2f7457dae997b3b26221234c7f53864e774501e1ea017caa5516152aeb9568d42c9f0a22ff
-
Filesize
8.3MB
MD545adba7c7636f7441f9b89f3229ce6da
SHA1e184a2dd4c4d6ab8cd4931d09269910cbe876078
SHA2569bfaac95304678f6693a6680907674279447f6755396c311bc0f1a4fc20e58f3
SHA51248fa798a2ebe7b20152bef16a9c0c450dc17f18cfeed7369646e0ad9c166c8bfa1993e55303d4bbb1694618fc5f859593c6dabef4b5f4ffce3c3dc932a88f765
-
Filesize
8.3MB
MD51716a293d06d4d5fcf80ade9bd198c6c
SHA16fdb41833017cb79d97496bdf3a6da03f00c7e0e
SHA256558bdf0969ed432e732e040b11522ef4e597a682bfcb89185fdc8054ae6395e6
SHA512ef742301431a1ff34a3be5f07c2f59751aae0f11bf666a08d893f52c19f28ef2482387202c1f00aec6c8065fbec3ccf2e35700dd43274b1c079b8185565e6b70
-
Filesize
8.3MB
MD5697861536732fcb5e673e12d079bd605
SHA18ec909b58772ae15896d4768b97e918ec8418369
SHA256eb1c003e094c880b035b86ee6d545008b2e3954e74bc395fe24b8f9e09a3e6b9
SHA5122d0530b7a10345234c78640a905a51d49c2ea0d29b3cb3682a6d5a0f8898d59791e623383fb020f3d1f03f342e6eb61e54d0990130f162018f464afff14b9f50
-
Filesize
8.3MB
MD5e63d23f0b426953023f6b98e69569e32
SHA1d873d191173c3cc130450899d1329c59c6ec6521
SHA256d5d3430f008a290129016f29e399a3559b69aac108a4e401976db7ccc8e16cd4
SHA51279971bd906e5233433395859b9879282ad00c48ea4742794371d801b769404b5cd6a2bd6b6ae3b8fc9e0fbd73bfc10d450733fb445c4a7746451ab55f76741f2
-
Filesize
8.3MB
MD5e783cfde0e35c5ed40300d8fe68f7f54
SHA15e53c80cbd7eb71942196baf06b68dac7fa74722
SHA25636160f9602459c060b691caca094bad427a9685d3610a55a5452a808a17f7125
SHA512cde9f46fc9621e07b85f257cdddf59d99199b92a04b13bce812dbf54fcfbe673414254acc2f99669cd4d793a6c4fc89f61dda9fc37ddbb059040a6b7bee91a1f
-
Filesize
8.3MB
MD5e96ba6e31d437cd771957f7a48864822
SHA1388711e4c4c40bc5a75c5b54bb099cf74fb2d9fa
SHA25681c0c7d4d76ff95372955dd110ff5bca0da2513ef25a3773a27dcc0b7696c8c1
SHA51283a75c6427dd5d3b084d88c18466253ee0edbfbbe799da090a18f4b305bf2a293f089a15223c2857f0c1779112b565cb2a42140b81a2f89a2f9ecde98714322c
-
Filesize
8.3MB
MD5defe7e2cbf265fec3ca4e26329200652
SHA1b26555d7db174ad25f3982bd5591655037de8f80
SHA256703dbeb3e18c02a9c50f0d06d089afc08140ee423346493d90acb3b6b0e18666
SHA512f18b30014e8673f4b8dd7b85212ddebcf85f6b7b2d19455f9b47ed4b1a5add696753a1100f6deb99167ee07e48ec5cd389fecb6c3bfe571628ec5636fc9a57d1
-
Filesize
8.3MB
MD55e67104337322a9627f113506d535cc6
SHA1dfeb0cdb1fa00d859d9af567b46008662c754790
SHA256c184544fd181097a5a06ae302e0b324d96b5b0d4fd7ae081e5a6cca15312a752
SHA5122f86c5b2b7d961a52d38f09161aa67438f46c0f53a8ac47ebfad34475dbbf79f327c27e4cd04bdf964e628861efc8981252c444927d868a07b80464e08c5f431
-
Filesize
8.3MB
MD58a9b0e09fda0cbeeda03f924137f12e0
SHA19d1b0a7e89523fcde06082bc99be5f3352aa6b13
SHA256c2f9e3c0ada28f4b0e5e14519613159a0a14d8230214756f3036a73cd83d45fa
SHA51278bc11d2ff2fd9a3e84205a36b62c87ba251d972b0a5e6ff01ec5321a367acdc68208f47591abd4df0a2528f78b5a2bf60245b8a92c9d06bef8c5d4f46cafa13
-
Filesize
8.3MB
MD5f7dcfd72df06fd773befef7e514ceade
SHA1986f30807f770dc811656f2b0934f741948c4224
SHA256374f5815cb6c80e384e1430b27444a1392fa9ec68a6c71c91035474472f9c462
SHA512384d760a96e03f02dc3d9c32d2ea927759cec11a2bfdd2e16e6748b004e30dcf5fb5ecdc36be5ed11be5f2a35c79f6fe65a00314377bcc13b625805358ec01b6
-
Filesize
8.3MB
MD575eeb0bbdadc4685f6d6333f24e1e394
SHA1e1aec5f4e7f8508d76c44ce5cea82a27dcb0ca13
SHA256750c545467e92859314f9f698c36fc65fc4d93aaad5abc2c52ca529cc40667f5
SHA51238aa0d3f8024cde2bd8eb903eb350fe70290201a466271adba407870766a932171c9e1a7da4ce8f6a891de66c3f365fa671ebd7f3a0460b9ff3a8231cb57bfb9
-
Filesize
8.3MB
MD5683dd3b71ae483c00f12f9a8663f1cfa
SHA122d5faae1c60372136e20b381f8033454590bba4
SHA256a9a0a5a6b094402e23f877056dcd3ded544bdac703df6d3100fc9d63c48dc9b9
SHA512d6b7fe91efb7720a5f9fff477a5345976f2eb663473040229c7c3005ac6d903617d12e4314055675382102323fddd4ea6c013668634b7516e729dbca7d6b0012
-
Filesize
8.3MB
MD553ce941ed4553525256857ca97ccf8de
SHA17555839e8d7e2b229aac0f27147c4bf6c0fe111a
SHA256f2a221bc106496a160b19550ce78efb7517e350f966be47a284867e2a5fb8c36
SHA5122531333e3e8754a5c350dccb3081dc5e1fb5e1b02080e0079e29f1073d7a2eeb305e2a5285169e16c04b0d72ba0bf3458273fef4a022a339a472e42282c1699e
-
Filesize
8.3MB
MD598939e8817286a0b32f2f7eb2792e40f
SHA1693c2c03c0280642c3238a403ab285be2aa8e9b9
SHA256f62348406086c34dd379858deb7f1e7aebbe2672b0cf68ed10d7b61552afa0ad
SHA512a0117f29c64bea2ba577f2430c4235621aedafadce29eccd40efe08dff949e216b609544e787f7715146f3b3a4f200647f8d1ab64e48b406c9962a17e7c979ed
-
Filesize
8.3MB
MD5b7d4e500e6ce9d5b9e0835a9038e96c8
SHA1e143e5deb2962bd317a9da6bcf6aa3d283cf1a4a
SHA256c57f54a47ea5b218d587cd2ef5652d90bf18707a94456635df7504880350d3a6
SHA512edf2afa250eb22f2af33431b85dcf42bc477e9c8fb385fe97c033966cf20edcae75a5678ab3ad653a000b715e7b418246f164b30709db1651feaf17720b06f43
-
Filesize
8.3MB
MD5c02dbd3408915da38592ecc2c8e94913
SHA1e4df5bf808bfb4316547769729083788495bfd63
SHA25606dab4785be2730935909e76739ce4ccd483df68beff2b568b050ab79e214d50
SHA5123d3ac97ca7c5a8e3842c1df40667285e459187c01520b080fbde4bfbcc6654b0e9bb3ac6473ae49f0bbb2dc38f43d4846bdd4f6ec5f4b50748c24865667c0235
-
Filesize
8.3MB
MD5b996e3d9602f32494748ac3ea39a1ffb
SHA1a6b52409f4038113004a468ee3c4ae907b59c089
SHA256492c40c6bbef84950ef6330ffdb74abbfa664e903d50a1f52f866bf2c9653160
SHA512338b8a0affaf2df8d234bf3379f012072c13fd697a0d5cff35ee90befe4c6f8b572fa3456caf6e959fea9ab5487acc5f2dfef6332357d409610e8440852ee3a8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB