Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
29-05-2024 13:36
General
-
Target
2024-05-29_bda247ae3f547898a69397190e57a898_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
bda247ae3f547898a69397190e57a898
-
SHA1
586ed09e7cc674ee78d4f059991375491f3431ec
-
SHA256
78b3835885eb90a7f12866283d1d7b8dce16ef125deae7601b1d7ba9b56c62b8
-
SHA512
7c4308fb80343b02e12962c4e15c19f7d8669b2e4672023a1b16705edceb92869f8db9283325123790a429fe3cb8c4db4c09461860b03eb668849dd0627c4c7f
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 57 IoCs
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_bda247ae3f547898a69397190e57a898_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_bda247ae3f547898a69397190e57a898_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UZGjeeQ.exeC:\Windows\System\UZGjeeQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPUAYTc.exeC:\Windows\System\OPUAYTc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mEOwnFS.exeC:\Windows\System\mEOwnFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFDehuB.exeC:\Windows\System\FFDehuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJcOEzZ.exeC:\Windows\System\JJcOEzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfKhJKM.exeC:\Windows\System\qfKhJKM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OusiJYu.exeC:\Windows\System\OusiJYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uQYSgGx.exeC:\Windows\System\uQYSgGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fiPnkwJ.exeC:\Windows\System\fiPnkwJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQzprTf.exeC:\Windows\System\JQzprTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xFjNkAS.exeC:\Windows\System\xFjNkAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNlAMaP.exeC:\Windows\System\dNlAMaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DmajpOi.exeC:\Windows\System\DmajpOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XEwSHOG.exeC:\Windows\System\XEwSHOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uLEnsbX.exeC:\Windows\System\uLEnsbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ytCBjLo.exeC:\Windows\System\ytCBjLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHKcMGD.exeC:\Windows\System\qHKcMGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJYdnsx.exeC:\Windows\System\iJYdnsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\asQaiZb.exeC:\Windows\System\asQaiZb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkExTQb.exeC:\Windows\System\TkExTQb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXNBfiO.exeC:\Windows\System\dXNBfiO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53018f97e43a47a289e02c8d6a8e16b86
SHA18513a7374ebd44ba8063693b5dd0d7b101a4dd9b
SHA2561e9af5f6a8d4f9ea04dd616d8ebb178ff4faa0ebec9b0bad30f7c0abe4d7da4b
SHA512021b42e969bc1be6695cdb5f8df63f4b4512d1e1d65713c0e67b17b0dbe6ad234c1b9670b51fb0fbad02e743c01e02e39f1c6975e677aa8638ce19250cbc2863
-
Filesize
5.9MB
MD5a90b97fcc2aae554ce86f5705ad3354a
SHA134c59fd73ff1b54fbe8df1d2c872e2424ba8f195
SHA256b340f5309a4e36706000b7b9633cd74363ad00542827f210daf5f3ff34f26d77
SHA5128fac3ba64683bb42e9a8e2f497033af39880e4c7b1d6508f3a01432e5cfc5e5df442d20a576eebc5d2a8f72b16a70341415f54da11c7aa4b717cb64fc53d1dda
-
Filesize
5.9MB
MD5bd8642cee7f675ea6faa14a6f8bfef2a
SHA1120b4da63573c5da3201f5dc46977044bb92fc05
SHA256fd7f454a47672e8840ade476cc8781f7c2424624baf01c1946fb0898ab17f10b
SHA512f16a384a86644f004ff8e3d5b7feade0b6c46ce57ccfd7024d411c6fe226e7c92a7a737a1ad4a6123408a572ce9163742df539b9f9cb5a4f38bd796c50d27e75
-
Filesize
5.9MB
MD5c84cd853833181c98fadb42b2778f38e
SHA117403329f1af75868e7933bc93f77cbf56c4e06d
SHA25642df21f125377b2ac47d8b159c99365ba74beb0a853e74181971a8dfc64dcd11
SHA5126082db89a9f69369d6be114c56e6b7d2fc014644040ad1ee15f6cde3851382a0d0525be51fb7204f2b7d46c99731a8252356a42864f829ad40e94b1d45016688
-
Filesize
5.9MB
MD5424a949b8d0e09f12d20f5b0efd7ddd1
SHA1a4ede5024114082078d545f284eba9c1a0614350
SHA256f2274654158551a62c155fd869aa1606527b46b25e29a2324db4695592273168
SHA512a23f09ec28dde909587db95b5be391dedf7f55667f45abc6a0bba0d33ed2b572a73c372a0570ff2177c05cf990492a2b5bf99471cf68ba749c7048c64228f13e
-
Filesize
5.9MB
MD5066bb0d158a2379bdf9f57082c195f3c
SHA13982f7f90ddc281740b1dc244365a7d30a0997f1
SHA25610a997ff8885367da5b5b00e089897e5d98c67dc98f1249a17be13ee69495adf
SHA512466a388d35e7526526babd984089d82052c1fae9594c5edb32ad3999c1856d82df1cc44d18786640172c0d7b2a3b951a049c138cb4f57077f77b1f3a077fe4cc
-
Filesize
5.9MB
MD5976e767a16230b3bd9a904261d0e0bee
SHA14ed5ca64e2ae555f3fbcba453b68404b1c82224b
SHA256744a3de7bbf0a23f4b170cfeddebe61429f49f6a375083c2981147dadf63dc35
SHA512aae8fe2f9e57e3a0c3d87161e34d9c92d9e509326be262f99be67fee524e4d96253feaa870ea31bc355bcd4f1f6cac6f8df0735274de26e500780e437f4d5244
-
Filesize
5.9MB
MD58daba81a0d12708e6e11a13bf06c2980
SHA1259922f3b8227c70e655a9422214622d7053da6e
SHA256fe23cf96907b83b25c6643a7f794763a214b0d2b883d2ade1aa6c1de175cf03e
SHA5122f5aa7b95ac2e03da5a7d67069d13807b3c9d935e4f0a115eccd4caa4e4620d5b9c5f9f6a2f4facb3ad04709b123d2b73b0a85d5880fdeb8fae96a6301fd9401
-
Filesize
5.9MB
MD536b533c00cdb8e8f2c06b39a60e35106
SHA1ec67f9447bbbfcb1a36d8d06705619ebd23224c9
SHA256acce35477b7d0b01c562fbe7a0293525248101dc442ad2b63d41903de8ac91f9
SHA5129c51fcd73ec31ea35cd776a68c2875ec8e47a7805b83af952ea99396391214d946b9d6f84d1e1d3ab4ec4cc09acfdb03aebb453f7e703d450c78b81c32b0169c
-
Filesize
5.9MB
MD54c99083d4927f5ea643396ae75ae0ea1
SHA1ba834a922a65203f759beffc55eea1c9aeacbdef
SHA256c3e2081395059be927bbd6e2fe7fc84d411b1c22000e2fa909b7a3c0efd64f57
SHA512e274dd7ea083e544f6bdbe4a6aae6e9dff8788f58fe4aa39234b781a99c26074a5d8fadc047550e70ce75985158a52bae36d450cdf6fc82ee0c930d7611e97ab
-
Filesize
5.9MB
MD56a0172a163d580f5828b4ac58a2a7a9c
SHA18ba6d0f0ba808f18ef81ef038168353c7fd9e4f1
SHA2564399b82c073d59e397a6161e09bed331ef25b4f2fcbb5d7cd8759dec58b67513
SHA5127bf57c5113c473cb6f77c302bf41decb7a68eeca7722155a85bbf89ba949777f28d59eb34ce3f4face41326a6baaa6eee620b37f3f4589f19540b6069aa4ee23
-
Filesize
5.9MB
MD5e28d21846ae97d4590910bbf29030380
SHA14d3c903679f70d2b5075b6e65859af51561035ec
SHA2563c03f58d5fcfe10edd3f9fbb790a1358a123c31b27bce3b93132e8d2c112ec22
SHA512c30d7db338a6cdfa1962fd897a7246a343e56b1a43b8a416cca356afc55dab435d91a8ead5ffcc8302e747d1e83fcd9a4e75d36f0c0991278a678bbccf21b638
-
Filesize
5.9MB
MD5a9662c534eb1f5bef2d22bc6c94b8cd1
SHA117b34c9d2cd58a7a944ec919a07aa480133c2027
SHA2563e0d8db0f21cee9d537750eeb3a91c49aeb6251af37fac1cf99ba9682bd54f7b
SHA512de4c47c3d061b71c35991b4c3e55e149236fbbd1c63f19dd94440e5645e4636627a88c855e097769ced595a5c0baf8a5e1e5c8f73cdfee12d390bdcb43e69310
-
Filesize
5.9MB
MD53685f1d43e177b5b6a423d208d3a3133
SHA198c21aafa34554d8c1cf65cf6b707c256c32ec8d
SHA256d354895ac7e7f9362ff523c3e40a6e7d7b18577078969f73bcb35541cb65fc71
SHA512bef246048b83b5e68f82fb6d75eb23d7f518b912bf3a876ec9272d3aea49b52d7e6f0f9f65bc959759d5d00144e48bbecb0395b836a919d864b0d8b0be56e77a
-
Filesize
5.9MB
MD5c4f8b2dec254a06d4aa4dafaca299a7b
SHA1ef2d4fc624cd89eb9c6d14bc89928d7e6e10bfae
SHA2564f06765a8718d8fc7078b8e73b1a229d6daf25298fcc21443b16ff35a75d8b0c
SHA5122e6800780d7c5219965cf15189292b47ba2f65f4b05116d04e277fb2c2b8f72787557671dbf96e1462c90935b0f5083c9ed9b18c006688fc17b913308bc0b711
-
Filesize
5.9MB
MD536ce3bbb02bb5e6bd0edd755a60f90be
SHA1d5376eaf4932aa67218329ed13328ad410359f15
SHA256533bb49f606b2f34d3d3499b1a7e5dde751ab6eae931e327434a44629fbf8456
SHA51291c9a38839febfd63982a3a129b8c7235825d432827ee6a3b6a1c64e91b66c34df0d48d3467ee601a65f7d6618269794574b1f519e1fec5f07c17086ad067b25
-
Filesize
5.9MB
MD5b263362f2ba53db856e7c9c243a1f4ff
SHA1501e400c127c158ba8473d8ca12409d565843045
SHA2569b6beb4e19410ef578d001656e678ab5966c65ca34d62b1ba5dead9b92cb446f
SHA5125793397c20aea0f5340ecb55f2df394683b6b687e192eca01bc24a45c067e5e0106d36b491b13df05ab0c249498e4c38072258e3c3901df1cc69e9962991ead1
-
Filesize
5.9MB
MD5b61bb5d3c02def9c49219e9dd93056a8
SHA179286c0d95a6b8520107cbf7cbfe6518029e8f88
SHA256af275089b7d14ae6ef1bc93747d104e5ee7a5c8a9ed2be92d96ffc6ede9e3fc3
SHA512d71b89b2e91eae5a31068400663158ff06025d5e1e3ebcaadffaa6f3022550021973258a63f3051e5655c3dda6aec760cf65c74fb69102f373df4ea8fb061b1e
-
Filesize
5.9MB
MD5edbf5775924113ecc62a02237131ff32
SHA1f52aceab403956cceb76fc88bb0a115ad00538f1
SHA256958f150c6643ce61155f319b55c3112d0a394fc3768fca862f874055f7580ddb
SHA51285bbfad89f26c107d3b5cf8f2942b0750a948fb99ffd43424e5e2d91376bf547daabadbfe38956239afd92025e94390e78fd73c8e2886cf21fe412d7ee5c51da
-
Filesize
5.9MB
MD5820c5c6685548f8839745514666917fd
SHA14361279783e6f3295e64ca210f10f1b926221deb
SHA256077b87aacf3b8e53fd657e404fd0b6e626d69670289619cfad5492adafc3a027
SHA512b94b5e6df3bc37f2c85b68fcd7d0f0261a4785b638120216f9bc1bedd7196778ee4217127d02bde777bfb3fc1cce8335ce5ba58847a0f317d2d3260b6ece044b
-
Filesize
5.9MB
MD58fc6ae33787c7148374e88580e1ad6c9
SHA153f8e72b045fc9824a52c7b2a638b35ec9581add
SHA25656be8cc9a2b32233a63a8695bc969ada542c5c59829443f83e309564d88a1a2d
SHA512e04ee9bea0cb2bc748e59aa9980c9854e08488ceee227022b693a79ff15ac9d4e9ffea2b3c7e429dd490e25a79688cd567fd34fd6f43a7fb33c319add8ed7928
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB