Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
29/05/2024, 10:33
General
-
Target
2024-05-29_74ba46c6e38e987c225e446df110cd23_cobalt-strike_cobaltstrike.exe
-
Size
8.3MB
-
MD5
74ba46c6e38e987c225e446df110cd23
-
SHA1
2c2b6bd598c096d157cb4f3ef2167c8c1efd0ae7
-
SHA256
6b2b9dab2fa1bc859681c0693d07525ccdc7bed7af848730c4e72b1d7fd06979
-
SHA512
61171c2a95b6bf24f3857c4b47bb64f192114f591403dcb7b865ef28493501b7575b2772be0c9097def516e4526349fcae026ab7f55fa705dbee08cfb3ceed79
-
SSDEEP
98304:MemTLkNdfE0pZb756utgpPFotBER/mQ32lUI:v+O56utgpPF8u/7I
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 53 IoCs
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_74ba46c6e38e987c225e446df110cd23_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_74ba46c6e38e987c225e446df110cd23_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pFYgOrc.exeC:\Windows\System\pFYgOrc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FQmaAsV.exeC:\Windows\System\FQmaAsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CHlZoHf.exeC:\Windows\System\CHlZoHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAjJPzH.exeC:\Windows\System\MAjJPzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRQQgGO.exeC:\Windows\System\hRQQgGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHbINPl.exeC:\Windows\System\UHbINPl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDahFoi.exeC:\Windows\System\hDahFoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khsmIWU.exeC:\Windows\System\khsmIWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtNcWQZ.exeC:\Windows\System\FtNcWQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnDmQdZ.exeC:\Windows\System\dnDmQdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmmOfUo.exeC:\Windows\System\tmmOfUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RnylFGY.exeC:\Windows\System\RnylFGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDyGmdm.exeC:\Windows\System\LDyGmdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TljGzFX.exeC:\Windows\System\TljGzFX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBLUJmZ.exeC:\Windows\System\DBLUJmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyUvRVU.exeC:\Windows\System\SyUvRVU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBPaiBS.exeC:\Windows\System\fBPaiBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gIYqxGd.exeC:\Windows\System\gIYqxGd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cipSYBD.exeC:\Windows\System\cipSYBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHSLksv.exeC:\Windows\System\vHSLksv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOlbfMK.exeC:\Windows\System\iOlbfMK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD5cabf8660494f71110d2e72790495fb1f
SHA1b4af2134a4aaa03e075b131ddf6d78c01131f17a
SHA256cb1065c1ae368551431da52c2d495b9491fe02314ee395ce5742804473ada3b6
SHA512572c5c26ef4ef6f79f6f18907b5fa04368fbe84b5dc7865de2ae6ba877bc92532cb3400499ab742ab1e39cf6938ee7c67bb0982da0e5e782f73a9aa77263e51f
-
Filesize
8.3MB
MD5a19b734b384b6fc5c6ee24b47c2358c5
SHA1ca1db02a7da4673e783b0b98dbbb86a91b3613de
SHA2569c077d0b04ea26622ee85ca9dda7fc3f1563264a2796dec1201f2de0481b395a
SHA5123273e3c6a4dea8d35b56882e3c82cba27b580b34bfa0b328cd4b060eaef3ef130575a5d1728f8768f9388e320448f6ed3b1b125dd3fefe4684a6dcbdf4dbd305
-
Filesize
8.3MB
MD5c58adb43ba3c2c51a007ca0a1547b6f2
SHA12fc5564ef3a13a20f287c3916c620430e4d33906
SHA256bb1e91b22035972ec32a15a2ebcb9905063306285ea9f222affc19bedbd8f882
SHA5129509724a60bbe7ab9e2c27314be12c19b7777aee33dd78d229ff9687ed6e4a2f684d261cc07bfb2848bd7c35eeda099edd609352e734aee1a6c6e8cd58b2587b
-
Filesize
8.3MB
MD570983ab4361efa907aef95b50294af0c
SHA1ed7f282ddc56e609e7e20ef347837014fe0b782e
SHA256f315d86178867ae08bbf864063c0e39f78eda5cd39e988f88d22afd8b17a7648
SHA51240e20560980657f7b85a05f89a8104f3bdac8318e1568880958fd0136838d7fa664addb393a7087cd7752287607512f1678496171db0696d0a9af0df665883ce
-
Filesize
8.3MB
MD5fbb1a4cd25a9f68dde2f3affbe1ca154
SHA134b606e12fa2e836160ce9a9f12fa1b3afd048be
SHA256fc024d5e128fe2e17815cf09a36186a8b349cb097f056ff6425319e81e8ade5e
SHA5123391dd263c57257f3f1c32f9811852e236b8f9636bf3a5d2e48dce4c923147c4c8d2b16570dffb861721bded76ab015dd79fe05011d7c4be4ae9d2808197e0ae
-
Filesize
8.3MB
MD52d323face91c0547e2428401f318fc0b
SHA13fe93510a67b1dc1efb913554376df3c29c99d0d
SHA25653a450a17576df206be73c93fbaae30e16dfe283f3b5553055986b4e4052e245
SHA512b60bee968e886d026395d8b7b91174ce9fcf25d83d365b35a1431723935876bbf6056e38653fbe052c3ea000b7efd2829b658c920684c15b065d483be99aaa8a
-
Filesize
8.3MB
MD596a6c11792eb094c3c8e0a0b37e67336
SHA1f5d407267821501d649ea009c4874262380787e4
SHA256d4fe4201a6663991ce39f85e6d31d64418b6b109b32226c5bfb801ff27a5d005
SHA512d7a09cd2225d69d513293c2ec50d85c63a09173c23b92d80e9bcf8263d0ce22e9a7191f06b4eba4176f48cef80de768f32de90c919bd37c692ff02d08427015a
-
Filesize
8.3MB
MD57db3df8b7f551cb71096647fe2248e6c
SHA1600b207bdc3c9f4e059acbfd08d747dbcc1eeeb9
SHA256173189d6f325db11e60cf8def47082cf69c52d53b4ca688569eb5ccbd532dc51
SHA5120aeb0ef16f6d1bbf4073266f200f51b3e8745dba6b2a42bf96c259fa63a0e733e4200db2b0701dda5df654016189cf44166b8c33a7eca9cfdbd6770a0611c4d5
-
Filesize
8.3MB
MD5561b8b926f03d20d125dbf539ee50652
SHA195b1dc40b4b2b863508109d79b4dc495e1aa6544
SHA2566da6cbedf67eafe4b9149a543100b0f16647ce5716b210d71dda2f2044bc84fa
SHA51238cbd0f8603f556cd6bf05d004dfa43462d4ce4cfd62584143d2ccbd64331810d6fbedfb8e102bf108bfb14e62ec839d6f27b23d4f08ad6a53fe5e3b42a9523a
-
Filesize
8.3MB
MD59f84138e4e434bd0c2389f566700ab8f
SHA1e9e8af2b3364d5226908ad8022852eb3332e83b6
SHA256f459be7878061ce07c29d70f44d9e2f3a74bc826947f12122bf211bd943135e6
SHA5122303965bdc0ae4d34f7c12854fd6fdb6430f2503e147f762b6c5d81be53d7046c0835c56979fe0796033dfbf5bdd9f457cd2ccf5cd3c542c15c38bedeae693a1
-
Filesize
8.3MB
MD5cd8a178720d440b6e01708998fe9c9d3
SHA16f8043c66278f3557833e77a42b102bfdafdfb7a
SHA256156d6d447c40f252d76cb00ad8f5f02a96189ba6b707188a546138499d4129cd
SHA512e77cdade3b81b21cee9645bbcc4331d050e2391cb65d86dcefaa2607478ea3d2053ebb2a7d72452854bd2f0324a5007803f067962792f1f22b1e126811b3ac17
-
Filesize
8.3MB
MD519410f6fed1e30606ab90561968fd8b7
SHA18832836ceff15ac457462486280ec99ece17312d
SHA25667547ef6e2552a7825fc730985d05a56055f7cf7f5212d9c039ab7be9cf7597f
SHA5128328cc28eda2b0c9d0c265d4a9743152296bc779d197a102cae3c37b78c737cfbf7c49a238544139cd63baab90936a1fe9a3c575d03db4ac2848e08066687012
-
Filesize
8.3MB
MD537bc7a99fae57a6f448a2759dd6d85f3
SHA17ba33830a61c906cc4411c7bc6787d1429f077b3
SHA2562be01cc0c94dc302666c8293cff9db7eb1db14b1a6e4e15526a39ab07ad4b141
SHA51217c160c3a2d3b7ff15d1dd29ecbf5e52d51cc955a5e56bc63aabc7172eac6c0a07a5108d56d10e0432519a9dd9e946088078a64076192d1cffa93f87f6f4dccf
-
Filesize
8.3MB
MD5706dcc8804861642725c45590123d90e
SHA10ebb75a6261c0b53088395094e1f084050d32bb8
SHA25687a3883eb76fa0e71c97735b9c159d3d4fd8235fe9ce0cb7644bdf229af4385c
SHA512b94e7087c8098f28090514d4b4f589211c40584e6b2cabb630c0f129dfeda8eed565aafb5162c5e37fc49388f3bf4dacb46cea286405643694b1a2d9c873bae6
-
Filesize
8.3MB
MD520521e3b4d8f6c26d1856176ee5f8fe5
SHA1b9f249112be563383363bbf498ba9073b2b286ad
SHA256d8183d890ee3d73e1ce75596dca9e6ee40dbc68ee31006cab74b2f184cd83bff
SHA512c740ed2f4a3119fc68eb879852daebbbf24f865cbdaca75d6bac9a6bb938083673de7ef6be2a44ba5aa752c531fde4610d3bc851e06e0c25c4a830322680d3ba
-
Filesize
8.3MB
MD564259839b339fd1f0f329f343a360af9
SHA12dbb05642576034cd74557e1a9b6907c5f34b0e7
SHA256cc942821a56d4573bbc1b8e43ef4bc523546d7355b6db2b40106deaae846a07f
SHA51247ba161fa785050f0104635326a4d8de73f9192d447392e987e417113cd2144e8ffafc345e49e959e7c115b1449133d486a7f33657b6deca9d9d97bc298ca69d
-
Filesize
8.3MB
MD5d7b5719ab6a7a45c230ba760732fa597
SHA1c88536c9d34c9ed70b6069d0a068920fe00e77d3
SHA256d68be608e2b2e333ab389b649eef9b8c2785b0ee645d1db93b2a06f11f78a01c
SHA5128ff3534cbf461a97865935a52f56aa7eea73c86c21556d824e32ed4a752767be65ca3dd42ffbba229ed9c079325cc4310d6849a8e9e90e2cd11f75b278a6d021
-
Filesize
8.3MB
MD583bc90e22f0415eddcd80b3248370cb2
SHA112e5d3b12ef0b275a8965e6a82bd4ba3e2abf103
SHA2561d99e6c2a5395d51c0a012b90dd4f23aad3e8b26f4b8da8770f7cd6b2edc6bdc
SHA512492ce9a0bab8da23b8d2f7ce56911594102698a4ff9c641a76b222813a7adf9539c2d9071912610ff00d5f401bff0bab67bcea9eb1ac6fee7b93021e2daad29a
-
Filesize
8.3MB
MD5843edb2275d4ff0c96148ffc3bb0bac1
SHA126fdcdc7961f152f0b8267f2f37f10385aef9b84
SHA256dec8d3414b572443c088b0cccea2cc8b4c48d49d2a65d3d59addec2b374c19aa
SHA512bec24f2cd7258fd6c4fc5a51b16da87521a88a6c29f81caee90eb31a50840c3a4fd7f83a9c78a4e8e05b22defcd8002a1bdae1a802b21f567eae473d71a27d45
-
Filesize
8.3MB
MD52fd80effd3994ce7d630226059e4bd33
SHA1e0aa80af05d7ac59bd97f0211440f792d69fc557
SHA2560e63d12275edec3c9df9c44f700d1c0d5cfd06602c4b3a7b3e4a6b38d930c12a
SHA51297ab2fa54e5b511f4b5855c5e107f6b807e32a68f20070a3f2043cc0e9637d0ef4c41e67c6524af226036938ef39d6af2a5249ac54b4986441f3f55bc78aa393
-
Filesize
8.3MB
MD51dce06de4af599d0691e5c5829d5e284
SHA185bd0eed082442bfaea8f0473a64bc341a7ae1d7
SHA25640f45d3bad0ba5b3100b5b4b7fc520ad7ffcc0afc47377d2c0140ebd84f0582a
SHA5129ed96a0d80f731d499a937df02796ab5ef6228148362cb5d25abe24a874acab8cddccc5e6fdaf9301ff66efc1bc7731d96b1eef851c5be2e70006a31c02b2f0f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB