Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/05/2024, 10:05
General
-
Target
2024-05-29_1a252e38b32954baaaccdf9e4e510db6_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
1a252e38b32954baaaccdf9e4e510db6
-
SHA1
5e2be8f5b1eece01b069c1b99fb5275b779aef54
-
SHA256
193ae54886dfdd5490c2e9be29c6e86ee938af21684c9cd0d5cfa2667707c75b
-
SHA512
78a58b6111dc6aa9671679c72bc87b4e5f76f11c997680ed1ffd5f7f59b15413370a8bed2f65b9a077d475c563cfcb3a24ce455d5ed427e16cfb1b047d39c3ae
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 55 IoCs
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_1a252e38b32954baaaccdf9e4e510db6_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_1a252e38b32954baaaccdf9e4e510db6_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LGkmTiJ.exeC:\Windows\System\LGkmTiJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXDSyEK.exeC:\Windows\System\sXDSyEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRKSxIQ.exeC:\Windows\System\pRKSxIQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imrggZj.exeC:\Windows\System\imrggZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aSqCMMu.exeC:\Windows\System\aSqCMMu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GfZKoxw.exeC:\Windows\System\GfZKoxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxDvPUA.exeC:\Windows\System\lxDvPUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eykwBjZ.exeC:\Windows\System\eykwBjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FZXkyni.exeC:\Windows\System\FZXkyni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHUfzDw.exeC:\Windows\System\dHUfzDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raFUxuo.exeC:\Windows\System\raFUxuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yXfNVEw.exeC:\Windows\System\yXfNVEw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugQLMos.exeC:\Windows\System\ugQLMos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dvBcycH.exeC:\Windows\System\dvBcycH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzGkizV.exeC:\Windows\System\WzGkizV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEfSjTj.exeC:\Windows\System\IEfSjTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aRCTljF.exeC:\Windows\System\aRCTljF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\loGapqh.exeC:\Windows\System\loGapqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEddxtM.exeC:\Windows\System\eEddxtM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyUDlkp.exeC:\Windows\System\QyUDlkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zNoyBbp.exeC:\Windows\System\zNoyBbp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55e384422759649b55af5b58ee8ae4e6b
SHA16e12477b15a999a32dc057d6715e6ca4b77083bc
SHA2563f4113d1f2f439826cedf85faf38b5235a268fca0456a2eaa5289b21c5fba356
SHA5120d8aa9961ab4aa1f6e05e09446175a2b4667418d63d5b465fa503f329201a3a296128381bfbf2ee924c32adf64c124631861e4d6074a8b50ec995bd473be0e0b
-
Filesize
5.9MB
MD595946965b99fd0d83b1dc32d8a1b5781
SHA1b0cb85544faff1f8b6ccf0c806b75210216b831a
SHA256fbf40812887681a8f19c42a19b7cdc7d1fab6a4f5209c315e99b0fb8937e85eb
SHA512c8deffef564f7fc01aa99d0affaea5200ba05a6137cf8dba5baeabb47c49bd687727086f01bf9135395bd8ed0ac3b3b228f4adf1af065b8293f057f495c8cfcc
-
Filesize
5.9MB
MD5c2259f6792733b697b1c9fc68ea304b9
SHA10d90009a0526ca15d54f1fc3554bc4e6cd454ba3
SHA25669f38efc7751443166fb4845e2e60d85dd80c99866f479d65bcf6848d8d46b00
SHA5128b2a1556b0d4908bc77d7851b75fc4ddc9e49a154393ee769fa6f3d4c0ddf8543706125eb0182767e4a38910621da4a9d9f9cdf2d94a6c32a485945ad5d35b16
-
Filesize
5.9MB
MD5f6819869f13f8013ba3be940919813c5
SHA121da89cfedb6e7f5093036b9fc24e4e2d6a185a5
SHA256e06d2d5d6a499985fb453f05c147fcfb84dc0a93e3e9669113cdab213826cfd1
SHA512ffd8de112c58835dfe3456bb56aa14894cd8e37636b13211f08a241c3133ab25f2afdfa3913fb665480fa907074d1dae9db5ee6a35511b4958e4c7bb0fe90395
-
Filesize
5.9MB
MD567e73e5117748fe7122f3e053f6ceb69
SHA1fc53c291bef5ab242c04e21c01fbc9981df1f0db
SHA256ee92411fb1f6dfca5abe28db31ecee780d934ff5a84b9ed8fc486e504b3c94c0
SHA5127e38087b6a7caf16e609cc259ade130c98e2e4927701c25e70e3f7b93f5bf38279a502e657a0b54d9660822cadc5018726281d59cd44891722f8f7266fdf7196
-
Filesize
5.9MB
MD54228d4a38130215c40d7e59c0f1582df
SHA1f25359a66c0188a863fdcd33451923e3fde697c0
SHA25682b7c4bc6b27318fc39de6cb2b97f6dad199afa7e04a337b895e765177b30825
SHA512e5e937819d688128a9f589cd00deb76a8b9cb9479f6cb0d220d0285f3a22e13bfb7e4a0c492cf6ec86c3a63239471e0fb1b825551b3ac8e31d5348116c674c20
-
Filesize
5.9MB
MD53d2cf178f17b7a6e2fc2b811d185d4a9
SHA18bd1a4508dea425a9347c0b23a4d58d5a10f8232
SHA256d51d6ab14599776419e1fecc5410b703f00ac3128ff0b26b58f7e82befe47b94
SHA5122477f928d7c358b48dbd85963b76541ac181488d36d19f90dc38c1c6ea07d39294ab4f76993b2fd4c26395fa0314faa5dce9f960802c59386488165d017e45c8
-
Filesize
5.9MB
MD5796847dbc646e72b9e7eb96f75c76974
SHA1821fe73b497a75fdd5ab4515fe21a1d0e9e7f732
SHA256520eae1a4967e4fb5f77a7908fb43790765a5a7b709f183a21a758f5eb09af62
SHA512f5175fd55599a2d2d78ec6a8e0d64ee7668bc591a9f9e540a8bb1eafe379d3f8a1325f4f2cfb42289a84c15ce47272b0b8dcf5f0fc4e332106fd86f41d399a88
-
Filesize
5.9MB
MD57437e4c31fd5b0d39029c5ea8e469dc9
SHA1ea91b0a200b1cbac81453f548ac7d636158d877a
SHA256db7f580fd8dc6893fc0802be0924b841a0e57ced6997c2fb8c2c8d5258c7321b
SHA51287d681d89372c8a1b56e266575af540cd187ff39a3835370f801b812919ddc112851cc8432cd1d90cd41bb8de2dc44e3cf8136999707628f3f49ea3c5745c00d
-
Filesize
5.9MB
MD53e3e9d8e92848c09923d9fc2788891b1
SHA15c6bfea91f584a3168f5339c862bae2dc9525103
SHA256d833d298adcf80169080d7324abc7bf80a4ca96f4697f5e94199045ac63ac631
SHA512daae2e4fd782e1f18234a36e8bbd536773cac63be452d3a3f12228e5c6823249da745841b64ec53ca010a92f5e45622d1396a5be3d13c715d8c839196a260d95
-
Filesize
5.9MB
MD53c3ee7f9c429484b21e4f907e3609c62
SHA1d5b5e59b84244d9288965e48372bbc3acf911742
SHA256e0ccbcfb8fe5580a5a6c15e667448cfe4a7cfb79a383be61e33a7cc578a9c8cd
SHA51277aee9c7026d3a5ecf93a1fc428352c533216bd0eecde2837dd2a048aec1e3d3c3db7f9f3b09e510be9006d83748cd7ca4f32d69457115a9a98ea7a7deb9fc18
-
Filesize
5.9MB
MD51b35a0bb000f8f656326f4cc755f0809
SHA176572c20743d2acae6b810d319bfdca3e69ba7c6
SHA25697a2d3cc1dd9460e372da0e84a0bdd53a9b2795c7aa7e89834729d914268b320
SHA512fdf6948cdcef88568a99a62521b2f174cab0b356a330a5d386f86c188a16c5e8177f6f6c2c7fdb67027db8c4f01a903006e687951931abc5333a4160f576c827
-
Filesize
5.9MB
MD52452234a68caa91efbba9b308c47f6fa
SHA14940f9115e6bd7fcf1ce3c8bcec216cceb8f6e78
SHA256306beaeef6d7cdc74e9ba503e9d5113cd768af0d741bafbe77ac8179d6ec76e8
SHA512f41dca3b3885719682dbdf9b8c93737e869b6174655c397ac0a36135722748549635c1d1c365dd96af65ea1306acf9fdebf83fdb8de389da93ac51f41bf67bdf
-
Filesize
5.9MB
MD565c8dd757a21f8b0ec92a7a0ea920642
SHA1ac366a6d77b4eef923e868e4002099ce5da68542
SHA256f96f0b61ec22e87eda55626137979836b634383b934c1f23a5da14fbd97f4c91
SHA512515792df37a76c1a952a4edb3735a6d85edd2558b130f94123918149f69e68c3fd7680da061a11cd4b63f7fe76dca9a365cbc226e5a97e15cdb57904f07b3a80
-
Filesize
5.9MB
MD565c86e8672c031194e6271c4ceec0c94
SHA131b5f086fad043d7e7cc417b7655503cfe1396e5
SHA2562dde97fa245b3eb581982b448efc3f7c0f0d6cc72154d11a9bf0dc9b32fcfb4b
SHA512e5d7c3491e4e8c0a01c19b5e58d99bd358cd25bbb5ab6d30b8fc61cbe7d94395ddb84f4519ed222157b70420f61c9e04e2ddc951c0d1cfaad94f7395e9186a87
-
Filesize
5.9MB
MD5c4c425a9847203e7b04431aea4d3d00c
SHA1afec8015d83467c7b6e5ba7da878e5d31d86bfad
SHA25625c1078529ec7d2fd1d6350686e3037bf0c9ea4b223d77fae7cea67200b6fc7e
SHA512513cc696b0a7db7c99f34b896b7c291497200426f4c3705fa54f80887de11961b66ed45fd4e99176f2e677a4e37e4e403d2e9d4cbe1645f0145c1bcb2f07d310
-
Filesize
5.9MB
MD50d348dd50794015aca5244e30d6dd3cf
SHA1825408b1278486e17942e04735d4d5ffc1dbc08b
SHA2563b83930bf534777fc073c2adc0a3fddcbe4e96cbfb7f0422f1bf4f4cfc507467
SHA51279273ab9a40b6834bd6893a5b0531bad56e7831874ee66ae284f2dc61aa8591af937b8827395def06932e2b8e4ff6d7f77b3c836d8153fa1c97d3e060ed51b41
-
Filesize
5.9MB
MD51a71ee3f0cd94db3c29c8fe52d5145f4
SHA1a745d45ff328c7f2162f40177ebb27a220ed1224
SHA2569c6f5713f31b4d9fb7abff0c6887b257fc1a5b8264b41f556359c2bb182eb052
SHA51262c065fffb4d4a18c78107ee08e97455c1da45bafb510f45ffcc2bebd67e7fe3bae92cabff6a190b9d98502a546ce384433f08eabf2ca26fb67989b0628577f1
-
Filesize
5.9MB
MD5fa325ac460a973ec271b96201eec3c80
SHA10931e8f31a3827287f21718ef58bb1b552b842cd
SHA25613921bf1258803894292c68cc1e6a8aad547f9ffd6e2267249f5e5cebf8e8676
SHA51295ed6b60527d6bcc25969316185e77e303934edc7247d994d175516618ab4494b3d7b26ef0181a8deeb90f2b1a6f884879fd97fb90b6c7bee3fe38560d3a2df0
-
Filesize
5.9MB
MD5120fdbc5e3d6efc87ed8d332c3ef7b9a
SHA134d755a043b60741484430561b5534b68619762d
SHA2569d55d0961971406bf39c25efab2009d4f1490bd328f3f0d5d9cccc56bd4ec0e1
SHA512bcc36649ee2e2b8341cffe5e1359eab0184e7ff47437825533c118eebb27bd29a05357afe94f9709c80016946a165af8d45bae3485145971dc77b5c4e7b405ce
-
Filesize
5.9MB
MD5e87c153a1f3227a0d73b9489b394972a
SHA1adbc757cc5802b33ce5a916c4fa94ec433d9e7fd
SHA25646d0ab5cd110095ff6fe2e16a8ff071fd7f16d482ba17a97c63e48b93e3abddd
SHA512f1da24f287590bcec8a9e341effeee691620df82bcfaaa2857a357e9c0ee512415cf9b816fa3da3d3ad9ebcc2d7a7d1ad3aedfc900f9f00d9bac8dd9fafff389
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB