Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29/05/2024, 15:25
General
-
Target
2024-05-29_289b0ae0a4dcff2ea9698e6f45a99466_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
289b0ae0a4dcff2ea9698e6f45a99466
-
SHA1
8e791c837a1bacc1b3346886013e55fd06fac7ae
-
SHA256
3c79a9b858916e1af23434c0dc37b77966b4387eca93732c276aa7d76f5f348d
-
SHA512
bea0e8a3c42867ab283b05162a9715c5b1432063520d15f878a6d41510142743137c2198ac5942011d25da67bacd9f385ec3a4f73393a433af8121eb24e69880
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_289b0ae0a4dcff2ea9698e6f45a99466_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_289b0ae0a4dcff2ea9698e6f45a99466_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jdIRnHN.exeC:\Windows\System\jdIRnHN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swZJIme.exeC:\Windows\System\swZJIme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QqvNDtP.exeC:\Windows\System\QqvNDtP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZnLdvi.exeC:\Windows\System\BZnLdvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqPxgYG.exeC:\Windows\System\NqPxgYG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgFGgBL.exeC:\Windows\System\jgFGgBL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHGrHAo.exeC:\Windows\System\vHGrHAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgjGuDU.exeC:\Windows\System\xgjGuDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDkfRYo.exeC:\Windows\System\HDkfRYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyeykwV.exeC:\Windows\System\iyeykwV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fatmKSM.exeC:\Windows\System\fatmKSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\totXyoj.exeC:\Windows\System\totXyoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjzcwOJ.exeC:\Windows\System\SjzcwOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuQyMzu.exeC:\Windows\System\PuQyMzu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obmioMI.exeC:\Windows\System\obmioMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsDyPZo.exeC:\Windows\System\qsDyPZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ExUUjhR.exeC:\Windows\System\ExUUjhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\roGdvJd.exeC:\Windows\System\roGdvJd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlcIbuH.exeC:\Windows\System\YlcIbuH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MiuiIBT.exeC:\Windows\System\MiuiIBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNtTJJT.exeC:\Windows\System\rNtTJJT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD59764772b56293c9afcec8ee9e10b2434
SHA18353d984a48b146a40eec5cd07bc52da7f53b32b
SHA256c96c79d01d53ac1708ba1f88898766e1479233a2090418a4e0e0ca4fde89819d
SHA512a2f3244d76d90e74fb9592b25609ece3d77e9aa0ecf72695acbaf82634d3cca186b3dc0fda1bee54c6e70b01f5d2d71b48ed9983da12c4012a2739714790fe16
-
Filesize
5.9MB
MD5e4d5cd71877386b5213f3e311ecb725c
SHA11cd79e8e5a35f24aa6f9f964aab947586a13783f
SHA256c26167479c187b6897f91b72dc3251a715c14a28b0294c1c42aed634e02cfe3c
SHA512a38fde0d5110174a635b060c3686d6f99f5a88e883088720ae779db201ff2269e574d730f65a0394ed6142ca255f38d6c3696fc5beb5540aa0c16cdd777b628d
-
Filesize
5.9MB
MD58da5da0080438cea4fb3b6c980796cf9
SHA1277b09bee1db9fc407031e6ea40e5bc1c9e03b96
SHA2566274647d969d48220e48734683e1ae072e6835534d0ac7765d1cbfd0fd4c1a26
SHA512acbe7d37360cc14c6b5d7e7f5b2bb5c7e5cbc862297dd368c82bd8334cada7b844983649676b2d2364fcda1a7043ace36952ce24b2762e8796bd29e31a552df5
-
Filesize
5.9MB
MD55131d9a488ba800c452f5dd381354625
SHA1b105434ae4ef42347ac99b2429654c18086afd05
SHA256eb7e1f477a67cfb2900c10ba99fab879ed58b30770a3d0fda969de173161e863
SHA5127d5e6a2f121f9095ed1155758f36983a721cc253bc16f8ad1d611f3154702d5df51c7e370772fedf048b3c0eadbaca3e17266555e554ccaaefa1383fc19f36c3
-
Filesize
5.9MB
MD58ac3422e6b6b8480189526848ebbff0e
SHA16de5c528347de79ee8b3263e834f0a5bf51dee2c
SHA256a49226a8e1bc4c0a73b57329d9a7bda8034c3c6ec92544015e83a1291c618b01
SHA512a65e6e58504cd567825a92f9be7be0b21391f7bb7d7bac8f1e3806dcc8f9bea29839877b5013113960f3d0362ac4836c263d76ddee86fe7808d50aad27f898b5
-
Filesize
5.9MB
MD59bb1c9b822ccd4b48ba4988ee7108605
SHA17fcfe1530715e0715cf389a2595f6cd2bac5425f
SHA256db220201fe8c1fd41de9d4dbc8f1b05bce1ae78c610e9747b53b10899aefa8f5
SHA5120ceb8fc1672f051dbc1db54ee2a0759d41dada21bb35e3f71df6fad4f6b69b9959c9d425904d5a2e0891110158c0efbbfe1489d0ee61b6920c5a4791035d87e0
-
Filesize
5.9MB
MD5207542ff35d7511ddae2c550eedbfc97
SHA1b77f026f751ee349f0fe691f25f2f13ce9a5c19e
SHA256fd3d2b7bbede74e1ddcc93c26c77ebbdc10e1e63b79064567156b75da08fc29b
SHA5121ce8225d4c17d066fb611b0bc028a1b93069936005307db960b9c6362c94af72132b46e3c25a0a17eb050250b865c84701e20452b341795859dd32ccef098a9e
-
Filesize
5.9MB
MD50eff23fe03b6b164155add5574cc8621
SHA1c81936068d0bc6ecf03f8daf18decb5a1737cafa
SHA2566f8d0609acb2ddc30667735b0c781446384046b959c8b5d72abd27b01bd6a31b
SHA5128d98658975d8735302aaafd839ed58da8ca1ea61c3d630eaa81569003a9919e3ed111be0cffb0011bd0cc208e855287eec7c0ca56381b6412ce27ab988ef7883
-
Filesize
5.9MB
MD522500af49df3f7d5cb497f59f1d2343d
SHA108bcd83e4291005458b716eed9ac81db6f16b578
SHA256f77f91effa6a99a7d2153c5b1a4b014fd342a65c4911842061760b90340cf806
SHA512ca047b71a462d8c9d3b91263ab53adc3696921307f857af5a5661025e953ce0cf4f60017fa24ac1af010098893c992570e6ae4c89fc1a5118b148531289f30d1
-
Filesize
5.9MB
MD5116cfa79566a5d1a4771c4e5d5225825
SHA1c140429e61378d732fa04785e88f3b0b08401a1c
SHA2560659a94349adfeaeadc9fecd525b6dda7bca215e7eb7dec24547792f70fa3f58
SHA512ce8b9ea7530211ea4e62552df822fa54a0c4ee9e94b830d888e5c90b6a4332855b632291002204917e1f79cd1d706d57faf3f532abefe3859e26879ea5bea3df
-
Filesize
5.9MB
MD5caee90f627429590342bd11b3c16daae
SHA1ea11e744a69667bfa95581c742bfa0c7208cea87
SHA25666993c9abdeae63e73f81d45cddeee19c1847599c97ea3d15e5e506001eb76df
SHA512410d4020330f2a2c3f3739e2c97108bd6fe06625d613d25664f4c11484fb7f44d5989c36e9eebdc95dac36268f9ef12dfffbbd846c8e88fc72788ef784071f7d
-
Filesize
5.9MB
MD597e6c07d86354b6a90bee812b0be3af1
SHA1089923667a2522c692cfe1ab839c312ea11933b7
SHA256618992ec39e401d7e28b7602e7ebb77e5e4c58436baebd4246439970947bc756
SHA5126764f63b680895140a59f0c2e8cd0bf843958255b1fe940ea89b51857520c8e9cf7ed3d07df0c6c9b7a3a94f8b1f4a7f6b5dbf5ad92a0a159cc6297c8e3676e3
-
Filesize
5.9MB
MD5033d29a3df98e37ae544f8b6f864275e
SHA15b0ce463f8c61364473e0cbfab3ae9de686ffcb2
SHA2560d443c93d3fdec1d3a73b56f547370c3bb632d8093844b897137f3e1da536530
SHA5120eed706b29476318ff8048a6ea69d554d1c93f34edf04da231108bb75ea8dd2c4f057aa23ac63c5464226646264f809bd0ee757ae959a8af48e83db50e31a684
-
Filesize
5.9MB
MD575d3aacc47bc089b46360dcfbbac0cb7
SHA119aa10a33f367341903f1287b62bbfcec6a49104
SHA2564411467ac22831611655da9626cfda2668bad0b293348cf3af81245b04960a54
SHA512c1d8b74b94273260aaf5fcaf527b3e239c36cd3deeae60b065a643f793f9eca9b8c2da11de3e96fcb71fbc8a92623f87122c142809d01e30f79108e7d9833c7a
-
Filesize
5.9MB
MD5b9b19d182b50f03938e2c10d7b52df3a
SHA19ee71a82ca5ec4006341228a61b359f0262aa506
SHA2562a7126093b0156e3db4f010b2f2fa7101bfad3c3f81544cd9d81536e899d0b99
SHA5122ec8bd1f9b0a63ed12b7a94353da7de0b3e4a731902554aa2b1c942edc197c72fa43ffb0ffcb34bf04657a18d3ecd18ce1394e1b4fb0a22b780821dae7d7f850
-
Filesize
5.9MB
MD5c47fef8655ef0289b8554c55450cccf8
SHA12b4747d6694e04d4d17a487ae9aa4c87d2b917c4
SHA256c27ac2073eae068db028bf6626c20bef49a8ecbb42cb2e2e74f734fbd810533d
SHA512f228e45d581a27896790fed5a396c7af5886ebe812e614fbfd776e48c4ae9a9e16652702f0948d58f8e0acc759c063904ef297539e462307e2ba314af64c8885
-
Filesize
5.9MB
MD59c5e5cee7a65458c27b288af23014c4d
SHA14a1cc59216ceeb8c71cbdbbb69e6399d6f60e057
SHA256a816041ba2339c310fde29a201b41b7312b5fff11993946ddecb8ce94234aab8
SHA5129cdba238517602bf991b512d432ac17c54899d727bdd2e021dccc0498e624cd2138c121f8cd72444106e0b182f08cc4b0293f1b84ab7eac749bae4da02d57e51
-
Filesize
5.9MB
MD5b7e0a3cd92f8c6e7c7e0bc663eea513e
SHA1af561d0939bbe773bbffe4f72a7c749cf45725dd
SHA2567b5204c16a18da4643f4059423187fb5d63b0f78876ded972e4564c1b595b05c
SHA5128c7713336993ce6391c3f983a60f5a2c0f2bac1a1f91936b6e60a57509ec348b676dd4022e0432a7d3b43727a5d567be44811a26874e625c2543d982195cf9bc
-
Filesize
5.9MB
MD599c31942d149913e26dd9a71fab2b113
SHA18042aabfc056729713fed4366cdb3832a2ce49ad
SHA2566b32e399cfebb698844953bc0d75585a5dca0ab8410e20ad31e7c067fa43df3b
SHA512835cddc0cc2b80203322c02e8d8c26782f81e168121180640901a4eb7a52d740c5ff4a051de2aeba19078193511f4485e3a8ad87e6411ebea14ef89177122879
-
Filesize
5.9MB
MD5afe1ff1f23a3868865d6a623e55b9b74
SHA1453730eb97722869ac45a52ba0de7bfc0bad436e
SHA256681a932ca734219bda5540834a05e80e95747ec1658dacfcb50f637085bd0a84
SHA512e3ee5d148824d06dc7a43835c12e56b9c55fd515b0dabc7631995efc8d6dc88b33a49757051035e2f141637fb17afd7c754617c9306464a36bb4c1bd1a1dcd44
-
Filesize
5.9MB
MD5eda30f5f044b6a94ee702dc6d6b8d11c
SHA1404816de913d2c42ccfeecdb270be732b6ba1705
SHA256ce3c8b71aac273965eb5cdcf9b17c6f0ee4224079cec52efaf3e6ba272618bd0
SHA51294724e38af0e4a6ff3ee4edd2b2d39badda0e42787cef116bcbb9d2308a6d5c24ce20d944dae1d6c19cbbb54e102d70fb4594932fbca7af348e1fcceb9eeb1dc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB