Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29/05/2024, 10:33
General
-
Target
2024-05-29_74ba46c6e38e987c225e446df110cd23_cobalt-strike_cobaltstrike.exe
-
Size
8.3MB
-
MD5
74ba46c6e38e987c225e446df110cd23
-
SHA1
2c2b6bd598c096d157cb4f3ef2167c8c1efd0ae7
-
SHA256
6b2b9dab2fa1bc859681c0693d07525ccdc7bed7af848730c4e72b1d7fd06979
-
SHA512
61171c2a95b6bf24f3857c4b47bb64f192114f591403dcb7b865ef28493501b7575b2772be0c9097def516e4526349fcae026ab7f55fa705dbee08cfb3ceed79
-
SSDEEP
98304:MemTLkNdfE0pZb756utgpPFotBER/mQ32lUI:v+O56utgpPF8u/7I
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_74ba46c6e38e987c225e446df110cd23_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_74ba46c6e38e987c225e446df110cd23_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sqsLhJU.exeC:\Windows\System\sqsLhJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzgZCTK.exeC:\Windows\System\RzgZCTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzMEFRi.exeC:\Windows\System\lzMEFRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAMbkat.exeC:\Windows\System\mAMbkat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsNDBfQ.exeC:\Windows\System\xsNDBfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WYGwbxy.exeC:\Windows\System\WYGwbxy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\roXRxej.exeC:\Windows\System\roXRxej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DoliNZq.exeC:\Windows\System\DoliNZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdFrDqb.exeC:\Windows\System\zdFrDqb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVVDZhC.exeC:\Windows\System\xVVDZhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PGSmSPj.exeC:\Windows\System\PGSmSPj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNubtgH.exeC:\Windows\System\RNubtgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMOSPiY.exeC:\Windows\System\SMOSPiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrplNcl.exeC:\Windows\System\nrplNcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZvKEBB.exeC:\Windows\System\CZvKEBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bWAzYEP.exeC:\Windows\System\bWAzYEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKVJDWG.exeC:\Windows\System\wKVJDWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lEDqFfj.exeC:\Windows\System\lEDqFfj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHpfOUU.exeC:\Windows\System\NHpfOUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KAApZos.exeC:\Windows\System\KAApZos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uHtymXa.exeC:\Windows\System\uHtymXa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD540b5a473452c7b4bd1b3b28df66ae632
SHA1beb3b21f9a13afdfb3fa2565695ebc81d45d62c7
SHA256689ba780e161776530450de8a9943ed101ac33452b7df0d6f005fce52ed571eb
SHA5120cee3e08b3a9349f34c2f00459d14f9d40ce95fe457140c6cd5b4cf0b6550062e09ce0a1b3115d707312fc6fe76431b9f17f3cca30ad33ebb8896558b6dad0a2
-
Filesize
8.3MB
MD5f44602813b49db78fcb1404a889bd280
SHA10dd4c0649f8d007dc3b37cb99f6af759bd0abf8b
SHA2562baed79f38a3d8420abae71123974117dadc691aca99ef29c77ad8f471bea436
SHA512d121fd0a26f01bca2127d23b4cbf3842df560fbdf4b891946039443ea2db041ff1d12611026231b06bd7e43aca30a66972ac14c2b7921acd6abea993f311e2e7
-
Filesize
8.3MB
MD53f8447caa6285dc9b612c5a4ff45ea71
SHA1da1dbff1242afb95c05743051a07124c339ed4be
SHA2569b7deaa0b39150cef0e55500656448d0e30433b905951a758e41d330b4abbdc7
SHA512b12b40e5f4a6b90b85329749263d4a041ddf808e2bc4b68a0d125dea2e4cbf0d659aa3be79b5985d1cac531a15b91f98442ed212e15a0b23571413fdf82a063d
-
Filesize
8.3MB
MD57277195d059e320bd0cff837c5c5f2ee
SHA1bab0a06b24d4d10af55f7995ffb3337ef96ec1a0
SHA25635cfe17bfdbfb325d92203bcd333b1b779c2d2caaaea82ff80a27a7b67dd5b47
SHA512acd44fa3eb1156dfa2cbf9535c935c4f97916038f19fee65db3e82732c8e39695dfa05d7fa5a41e4baa384ba409b0b678ae8627cbf8b07a39756cde1d82238e2
-
Filesize
8.3MB
MD59d17d0de0a8e1e29eee9445f3a953165
SHA1f9574552bca1376b3c0a26aa4977a1942c2b8885
SHA25689d9a9f032594879bd884a6b54a46ac825661894dab49ea4604c79698b028859
SHA512f9f260c257ccf283ace03b191ba6c06ef5b48bc819d3edaac23fbf5bbd7bf1c0bd4cbe62fa6edfdf947882866d2acd8d670af316b38499878c373f5e13301da0
-
Filesize
8.3MB
MD51d99e4b381c2612098b2f381333daf4d
SHA16352799b57dc9122ddecd0e94dcbca090bb29b84
SHA256b57edaa2bc8e10e2bc53556b23bb424bc1fd84fbe18292e4606270c6d31741f0
SHA512f5a024f7d077cc140fc02b163eb729ccd593f63765f7c43879fd59d790be4be9fb21fb1a278392c79c44bb62080f5c566b9008a8742b5621921a8cceb350ecd4
-
Filesize
8.3MB
MD5e72af44406c3e87fafa5a87729323c04
SHA10ad61ae1d7f5f170ebbec60024ae4e16abfea1cd
SHA2562baf793ccf51db34bb7425802bb4f5b19580c812cb267a4f9fde37ea017e3834
SHA512c3510e3ff249598a0f55ec4d07716c6ca050be207cf524f79e109f9201b955a5d4f9707c6277edd9bf5bf296a2fe317eccba2877c87906d9192998f2725bef0f
-
Filesize
8.3MB
MD560d3fe2a7cef6f053faa4ad37cd23b21
SHA100ae2a84da353b42e3976eaf7914fea969b0db1f
SHA256264d1bb13472d8a4b097cc9830500e0892e99f4b36423e753cc21710cefae75f
SHA5120ba698c70ecc46e2c910411eefb847a05ba6a30dba81aa650c051a13e2708ea98893ced68bdf4b96a1fb03f0a8a716adc2c52eac9cf83b02cc5c8d78f933258f
-
Filesize
8.3MB
MD54ece9e933b8c7aa307170c87b8f0929d
SHA1d2b0bd0273d761587ac747aeff547eb05b01a1d2
SHA2567583a42f19569eca88473cc3d2041f809c1f85d41837a177d5a7a94273bc3da4
SHA512b9b5c6d57a6234b99d57d1d2d76875eab07f6ac4ea0201db50630321bf9f52d40abc50fa0a6279bed9499c656b97802d322857e360854220769655e5328d5bd4
-
Filesize
8.3MB
MD5b610cceef0984fa4ccd290fd805462d3
SHA17ff6d0b7ce63712a6582be22d3ccdda43534d989
SHA256268845b097694670cf49dc94d44895f59582def5d84c99e5381ac89bb1f03265
SHA51254143bf6c962b866a3a7dc862c6806f6d57ea9b4ad013c8514b12efe5e927637e4ea493851baef3ba12579d61603c3e9fbac059933b08beeb57fe57113dfc78d
-
Filesize
8.3MB
MD59dbfd6e890dcb51a30fe70d0004ed58a
SHA12f7dfa56ce4b2bf1619cb37f930d7da1e510cacd
SHA256318ed3ac179fe2567356d61e2166eafa8feb5f1dcd3e2e32f25693d43e271a18
SHA512c226e0d5fcbe02edb0f988d647a7bf8fce1ca3a913458ed6edc5f677bc528d71336dd131c8ccd920a5867c7d4fd0277ca225c3367aa7634d45b158e18da27de9
-
Filesize
8.3MB
MD5b483f1de545510bdb82f93b3b064154a
SHA17072c308bb077da64a95aefd8c95283acc2eb616
SHA256fce84dc0f7a92584e43712ba2f6b40f2b46fdb78d50ad8900fa8d475e7a043ac
SHA512b2cb21e3c018035e08da57d9fa5a1ae0e226acb3b5b5c998a9ef41dceac5133a019d11f7a8603a64976721ec5248332d0ac77d351acdde9bfd9f35c0b4ac0299
-
Filesize
8.3MB
MD5b091a63a1c8242182beb9410e9ef2d2f
SHA16e05a0649975475e2fca41bcbbb15ded8e27927b
SHA25692fd99c05c8dcde9cee97c15b382c0d8c9d4708f315391a78e4a8302f9b20208
SHA512cab45bdc2a536df3b09539938dc668c8b63531af0fa1d9b84d9aefa9d1bc77cd8b3d55845ada5029058410801a74bc3c5021d0513fc9f97d75e2e8944d5841ba
-
Filesize
8.3MB
MD5cd58e0aa41999b395187cbe6132682e3
SHA15d09d92989267377ec0684bf181fe6ee6a95b737
SHA256d3fe57145fdd231348e2faf3cfdf59c7cae9d13466f951911c5467bdd3a87654
SHA512e0edcf4a6775290040b9115acbf11858291ea1d28114b33abc665f307a55a62bac3e679fb75ad2c90e0d69f0a6ae1a5673de241137dbea112652d3ed4d8bebf8
-
Filesize
8.3MB
MD53bd658c4081c68b3b0d3161daa9e66f6
SHA16b3321480b8d1eaf09484cbd7b3087279246f3d5
SHA256863419dcaf96dc76ba50b866f86080bb410e91bbb050f5f91b4809b3aaad294c
SHA5120ae648bc2da77418cb857a440fd56f1be0b67ed382341eed2abba33e03ff65175ed80d44127279de933ef6ea64aedb57cde8a974bea317fa690cf59a4d728a99
-
Filesize
8.3MB
MD5765455ca60da7f128df11d829909dea1
SHA1c73727bb3e6294a518a98ee57ff8fa3dfed94d50
SHA256e8f4e8c557aee6e0808659851f6324069346d5ce08036ba8c7988f3b4c631847
SHA512effc3f09f4d9debe6956953fb7385840ea37d6ce8fde5f824208ce7c292f867237a7cb2c64a919828ee363ffc4425f68ede2d4e411d2de817c7bdbbbece01215
-
Filesize
8.3MB
MD5458b1263bcf3369aaa007c033fd96ac1
SHA18d6c964c0f61ec859c530066f92658cf4716701d
SHA256a4e3e46883c7b83895b63ed142b1c0525b6433444f8321ec09ba2910ce2ee4ef
SHA512f81c9319b40ddff709632338789297287af2d40cc1c11ecedb745b9d2b27f211459e5bd5228a9249cf1b0cf68e1e9921f92cbe471fd365203e3e0f88cdd2e9a7
-
Filesize
8.3MB
MD56415755e764e5dd82a8e0b709fe76a0e
SHA10423cc8e1efbb29a370120cf8750ea16a390ad27
SHA256932163391550d2041670e6d1ca40591f40ae9fc84e28a6feacc79b0a0f6d3be6
SHA512a6d01310c9c0e07c1513afdef90a9ebf8f2112a6e43376bdf1d944fdaca88b8445a3943bbeb4484026741bcf911e29747cc9b5b6f5fbfcc09685869e0cb5651f
-
Filesize
8.3MB
MD5697abcd1807adf423e45a55c8086f697
SHA19138e71fa4f59ac3df0886ddf9890be28db37e58
SHA25680d3aeea2a33c3ce42fd947e19bb9961e27fe35587ddfe3b6beba68274504425
SHA51263186adc55178c2fc00686c3729837bf9074ec09113df38c0791d66002c180c4ba0cab34b3c34ef1da3afb0c1f6d77f8281e2ec326d3fd00f971ca50e1bbd5d6
-
Filesize
8.3MB
MD552d9c1a663978f278c856d6b786a9ec1
SHA186474bc8010a8d2f64f0cf62a712436c0ba2e843
SHA256e417ab75f9dc5e5c8f21c44378cb4b3eaeffdc46ca7bb74c7d9cdce2852161e5
SHA512111b70b6ba7ecf168c10bae64b34cc62579925518d6b4e7ccd6f875f7e2292f10f63f96fb8bd80ebc2b988dd1fc8734681fc670df501fafaf2e61758100fa2dd
-
Filesize
8.3MB
MD553c3106d64c657a755f0d8be6684ad2c
SHA15f0df248eb68237b4ab597841fd15ca8ae8cb9c2
SHA256095c04a00f5837feb7b1427c07fe0a334911a80344c778a17caa5f84ff120421
SHA512e7d242fac240f35f4d72b218122b854516e1a805c9a8972eda1c79a5b442c48504832698399b985f1efdb2c62e8c05a2a32fa522f8c09776ced5eec3fa7273df
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB