Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/05/2024, 14:26
General
-
Target
2024-05-29_2886cecbde358d0d97f44182c8f98d59_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
2886cecbde358d0d97f44182c8f98d59
-
SHA1
8509d2a09661406dd6344b1a90f003371df9f0a0
-
SHA256
064250b58dc8990048c949e03326d4289a6fa66036eeb42b8f028a9b098b9a65
-
SHA512
6ca4f4fba18610307518f14695cd132595cde76a35d7df295932a9b7c2cd2ab349f8951ba7fa9c3f465aeb154128e5f10a7e51710208a9e1c3c3eb9af3e663ec
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 48 IoCs
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_2886cecbde358d0d97f44182c8f98d59_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_2886cecbde358d0d97f44182c8f98d59_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JppBmPX.exeC:\Windows\System\JppBmPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ofdDvLu.exeC:\Windows\System\ofdDvLu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QljIxJY.exeC:\Windows\System\QljIxJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EDdrkzx.exeC:\Windows\System\EDdrkzx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hjRCdfb.exeC:\Windows\System\hjRCdfb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDDAkPO.exeC:\Windows\System\rDDAkPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZHboVS.exeC:\Windows\System\wZHboVS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DACHrqu.exeC:\Windows\System\DACHrqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDuYdVn.exeC:\Windows\System\uDuYdVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAdoAnp.exeC:\Windows\System\wAdoAnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljrycvX.exeC:\Windows\System\ljrycvX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUjnFdB.exeC:\Windows\System\XUjnFdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dlohxnc.exeC:\Windows\System\dlohxnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hFATzLG.exeC:\Windows\System\hFATzLG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmWVNUw.exeC:\Windows\System\wmWVNUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lZSBPdZ.exeC:\Windows\System\lZSBPdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urqngLL.exeC:\Windows\System\urqngLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njhwyQf.exeC:\Windows\System\njhwyQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQwZwcj.exeC:\Windows\System\jQwZwcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDedkZL.exeC:\Windows\System\eDedkZL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFHmINZ.exeC:\Windows\System\JFHmINZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e354e6a428d57bfbc39abb6554d2a50b
SHA192227237f7dda4f861244199d2332f4c2c3d018e
SHA25634ad7382a06ffef1809b8706ddafeff44533dfaf9bcc53aaf172b42987c30afd
SHA5121a9ad44099b0e4e6e8e44584b3166d7806a9a501a945e44cc96e5c3b91b7f16d01814b7ec38fab5744cf8f39d57b0ca4987e131e1f2e20cc85313c8bb8168c0c
-
Filesize
5.9MB
MD5d7defd8c0e3d8f642f3843a1f2c97687
SHA111d633bdc6b84ae89fa62b1f5014e199de55e45e
SHA256509bf8f582a1f312661aa491143cd44b1cb00959c55ae1a15e1239fc3d868067
SHA512f0e58c008689e51a9fe9af5da921cce953cf7769dd10117b946d2a3c08ab99296879cbb2060f7391d708c8dac1d8892aa241453b669d65e6597a98b851889fa5
-
Filesize
5.9MB
MD5af9bd413b0a310c92cd507073310cd07
SHA173d474653bba32ada725fbc5b671af2fbabd144d
SHA256d9a65c1f3d603296ab811f007cc659e993e4209d5ee6ecc944f58040744ac25b
SHA512de0ceffef6b27ef1b886e173b8fe87713dc03337853d3533462c4a955446bf6ad39fe127898ffb1d14f328244ebef1270a61c1b03b9451a192c9b3bde9034791
-
Filesize
5.9MB
MD5cfeca91a686dd4c759c48a07bb9c2cc7
SHA1b99458eedf5eae6ed228a98a38fd451a0f7803af
SHA256fef9083bf3461ad74b129646e5d8f7b15b8873edf906c772383527fdbc315fd7
SHA51261a609a766b546e331f38c183fc6921b146ab1d5178a3b1a36bc809ab0ba8c39d795394ab726cce17291b778876fc880eb687f8d1d2a261aaf44853baa35a2c7
-
Filesize
5.9MB
MD50f62b949e2f347d1f61629a8fb90ef5a
SHA14a6afcf977cfb69b3e9bfdfd60cfdae7cad793fb
SHA256f5096d96de14faa9b46c4039c3803030b0077fe460accaec53d4ad50ab36fb7b
SHA512599a39e2d60c13cd7e22aa17dc363018158979a3ab2ae1c852cc7b4f87ac7d00a64f295217ec576893f0102940449d813d220b3453fa915bfd97e593d110b6d1
-
Filesize
5.9MB
MD5981414cc2612a0a325026213cfb076cc
SHA1cfde520f59e41041b4148e4f2ff45ce0d42d1c62
SHA2564cd7a6ed02fcb87f40bf4182f6eb5f6fd8b46a038598cfb53fbd9cb57068a0e5
SHA5127e72e6ab5dbfc2b25c968febdd63da89fa69518e78c6c399716fe06a49542eaebb9f84d4bf547c50897305d8e3a47fe3ee4a6f79258245f043c0afdeeb90f91b
-
Filesize
5.9MB
MD52f89b3c6e2d0a8b1863d09ee0d3a9ea5
SHA10ee47fb834dcc2db768b58ce207b189efde95991
SHA256c93f1dae9abb619e821099e5761551edfea854a55bd49323510c43165d225d65
SHA512abb5a469bfed073d4437a8e094592cf2e001da2a90e2261d9926cc538460b538809368a62895c74f8ecbcf4ef244bc273d59b5a91d304820a75179955f9413cf
-
Filesize
5.9MB
MD5806a68e4b0808488d2987ddcebd971c3
SHA12cc356d190189fcdf2c8ad9e992c17815393c5f4
SHA256ebeaafe6dc320278d2c277990e0e332b25b66b13f81dd938892e2e7349208ccf
SHA512ad04b1f089e87a59a103003204fd9b5961066d3b874d6ddf278d25d07c2b61c7e1aa386e12ac7c70ff256340b32198ee50199dc8665809dd3e89f55d5b8fd8b5
-
Filesize
5.9MB
MD54f4e707e0c87982aea65b5da80ab7c58
SHA10fbc3290c9b78d8571870a4813caf503172485d3
SHA2569b993f20c4be7c64719bf385234f12098cabed079cfa45f741b9921e0189f3cc
SHA51213ac137791489592ac21b5631a20385c59efbd710387749779103acd5c1b8221f5d17c6c7dc1354aba20d943110c6ffcb7948b70ceeddb30d408c3946544fd7b
-
Filesize
5.9MB
MD50c32d6ddc0f41bc29cb1f5cb96376681
SHA1b1e34caa8ad2a9bf2ca629e7a5d0305d3221a410
SHA2566e9376b60af3cec23142f0503a0668908cfd5948a0ea6bc50cf0b7c85c4507a6
SHA512558c877a33adba3952b961c34917bd8068ee578e6290ff87ad4f0301ac73dd1710cc2d2218cf6ebee5d0b4eb17d24595c6bb20ade2a0e98e0ad17cee91a33a48
-
Filesize
5.9MB
MD577d9722340e01e1bf167323d3f045f6d
SHA14b86f20b2b982249fd217b9e1b5942ef8b3a72ab
SHA25613f128bab0f6c53353e12f848047a74efc8521e79df981e2f2619610a3922b0e
SHA51295a913cc44a72a109abce234d15090b87dbfcd43ac0aedaf0608fb938fa647ce40f91c8bdc9df14953f94270e96947008abb4daabd9a40403b1d07bff7198439
-
Filesize
5.9MB
MD53f8c7d644276144fb3b1fbe1d2c8558f
SHA14aa56fbeb414ad93c9483638e57db54ad0d73b7a
SHA2564772b298fe0b75f67ec29af0d10952f8cc24fc3cec0cce8995039a592089c154
SHA512398d81aeda40dbf24b17b152dec3cefc5e9f57c9603f03d3470b2138af2b3688d139a2f47f1bec924b6a26b493594a67aeafa60e7ce8e90060b7b61e745eb231
-
Filesize
5.9MB
MD5982fb51a7908ee8bc0d3b2156fee7139
SHA1af1b6b112d1ac2256c7545d4f850cdf0163bd465
SHA256c20671658ee2f2d89ad9ac718c8eb9aad20fbf4de8c42a47a2fd350bf37500c8
SHA512538acf62140ada7eadd69200017bcd8d6a009660f35fc00c9804e2dd4ef22ea18bbdbcaa4ea3632de8aa59034138b9e0349fd8c96aa3cc085f599295eaeabda8
-
Filesize
5.9MB
MD5f1e83cae7b7d216d6cfc9f3f7d243439
SHA12c4057100996136e5908e1951a86b099536ab164
SHA25602bca53227788b23a458fc6dedfff1db1f2cdfe14ee70a278d0275bb92766902
SHA512e833ed5e3e692eaba3fbaae72ae603e31a6587719ef60ccd0b9bc36bc3b9d60c864bd036f0ef9666c24fdfc00140bd1a013b21663da6e57d379b21d88c611654
-
Filesize
5.9MB
MD5a0a612a4e5d0c3bb74c4fbf136a704f1
SHA119e7cefa5af50d54b6648b589c14f03cc8ca0de8
SHA2569fbf357916c0ab1484e1295770f21a19bdcec44ebee5f6bbef10201b32c2cfc2
SHA512ab338982586ad03314110276dca05828578c62ff9fa9a84768081302a3d4db0ce552db10b987a897f1fa19ea0f23e697cd1f0e4f22184bf090f6b187b9ea4d98
-
Filesize
5.9MB
MD5eb9e1589e98b3cab32612a4b57c1191a
SHA15828b507f4ce5ad30e0b7eb55e9b910bc543a2cf
SHA256976b70aa92f64263b3175f8c7ad7bbd9d4ce8eecf0be295ea128d24855da2431
SHA512c5058225b84d33d9fd8f727e6f4dcdbdecb2ef4ff3a5045b7f71712d97d9656ab769582c1b5f6151046b67c8e8ba47d89a8c3dab98476717cffd4f016466024e
-
Filesize
5.9MB
MD56f5b92bfc8c658b86288c9bef860cb70
SHA198f8dfac408122d51bdbac5b70e414d3f5a31529
SHA2568051263cb7900184ee9e9d57f9de75082c7bfb2074ead7ab24dc94a8f3c0781d
SHA512fbefb6de1d84635046e2cd3eadd499c10e142d948a3100d1a07c6a6e6a31980bb426dc9d295a54b7aebfeaf84a1c6d568c924b2bb81a7573056f386e5f30e76b
-
Filesize
5.9MB
MD58dffd45739567f39b3fd39080e8ce4ca
SHA13b935b01d43462a8fce968c3a257dde1bcf937b1
SHA2560cc21a9ab5f12101c6406e2168e61d5d7063b1745fe8e3730306d130f41784aa
SHA51213369971a9025c16771fae83327624ae0f5d1e19ed3d040d10efa50078d4dd3821c4203684ca379ebd21b1ccc5f35133a5bc6861190436adef8981b23dda0420
-
Filesize
5.9MB
MD5917f5fa8b7623781fb3851bdab25d1b6
SHA1861a8cf939611be875628ca16a83795756c7260f
SHA256852402f026e49de84d0d29ea35b163a0e0103b95543bbcdd8eadee28f2acb3ac
SHA51224386972bafe4871260fb8a9be731902edb9fdb94290d90dd9ac767c2a3e277809941773af7f81d19687aefd1fd5804ef64e3bfc5913efb860cced027fe7abd7
-
Filesize
5.9MB
MD53f2dbba5a891fddeed9b508acd5f2076
SHA19c87d25a89fd1d03f858be76185849b7a19fcc50
SHA2560cf357fd35e36cf7947d5183941c097be61ddce1d911872b41ca0cdf49ef7de2
SHA5128c27ee5cfb84a443f3e46b8399ffa1499cdc5d9bbf5db0ffc3b68311f7b206e97372bec69bc051bcd94128d98171a498d69c53b4bf5f2bc60bffb6cf244c9f86
-
Filesize
5.9MB
MD58c208678ae43a6a9fb5261ec0049d7ac
SHA1e5650c9d22fef801486722b2b9aaadd2a0acd085
SHA256a71249408fcafb894a352002a9197bb1f99eea756574e714ebdc1b8522f06c92
SHA51229b9cee10821152adc3216436924adb9dd5858acd378a3c3be3c6d3904dc605106323144dcee273cf4b4eb4b229cb57a01ca11c86d834264cda2c4b4a3307dd8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB