Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
29-05-2024 21:09
General
-
Target
2024-05-29_ed398ae47512513b1039c6c730bbfee4_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
ed398ae47512513b1039c6c730bbfee4
-
SHA1
6b86937c67b8ada7f5ad93d6c6e34bc46438e7a6
-
SHA256
726914d628598886304ef351405730241e562ed8585971a69f30e528570d2f98
-
SHA512
f98502bbacbaf685ec05d2abfdaeed198fc6af82111374da4f41377e8053f2e4c247a7fdd67166322627c325bd3d2ae52e7a116c24bec62b6c4320d8f53be487
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_ed398ae47512513b1039c6c730bbfee4_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_ed398ae47512513b1039c6c730bbfee4_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CNOuPWa.exeC:\Windows\System\CNOuPWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MjFImqY.exeC:\Windows\System\MjFImqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igoyOUS.exeC:\Windows\System\igoyOUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtDWUFd.exeC:\Windows\System\JtDWUFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRKcMFX.exeC:\Windows\System\rRKcMFX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rAsWdkJ.exeC:\Windows\System\rAsWdkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nuUciwd.exeC:\Windows\System\nuUciwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apvnSwb.exeC:\Windows\System\apvnSwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NiVgHNl.exeC:\Windows\System\NiVgHNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nLqcKJZ.exeC:\Windows\System\nLqcKJZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWzleJq.exeC:\Windows\System\mWzleJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BnFdVRx.exeC:\Windows\System\BnFdVRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUNDXIF.exeC:\Windows\System\SUNDXIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSbMTAQ.exeC:\Windows\System\tSbMTAQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CnoFHNp.exeC:\Windows\System\CnoFHNp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzimpTo.exeC:\Windows\System\kzimpTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKWRkTY.exeC:\Windows\System\nKWRkTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOGbRfZ.exeC:\Windows\System\BOGbRfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLVaQZc.exeC:\Windows\System\FLVaQZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFVYQvY.exeC:\Windows\System\DFVYQvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUuEYAj.exeC:\Windows\System\SUuEYAj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a37739597bea2489b37321984022375e
SHA19665eda95a0d914087650eb2b2c9b2ddfa81c608
SHA256dec57f0bce78ca81b4e14370f19ae4b1147479300ebcd5773eebc1160b6c9592
SHA51299cd3e6d6d7da653979481cc368ba27d407f4d4e0bec32c907010da2cc81c8c027ff53fd415cf5fc0d9cc149a77069fe2beaaedceb2c151d4426d8772367877e
-
Filesize
5.2MB
MD5e2497bdcf07d478a13a30061aed63f51
SHA1677200aaf8263da09142a6c6a8dba141b9eff6f0
SHA2562598a11136125e4f431ff12da3d22fb887e501220acb7e09c219f84339c90ce3
SHA51204e80e04065e0668060c90ca022a6e18454983b8d8ae273fc58f2fea5ec5fd012843ea9c23b687720fe604ae825d1ac5097b1726982ef51bfd917e2b4ffbb636
-
Filesize
5.2MB
MD54876da39455f7939dda1147ce6ba2dad
SHA1e575bab02c6d19a1c8acce26a2661ed19243c9bd
SHA25687f9748f7fdd38bcdc68613ead2b83684431eaf2f5b3a53cca9ca04f5d89350d
SHA51285227e9bb3a1db6526b9076903bcb13586244e1f621b51a46d7f93ac6c2aab683ae8fdd48db031cbdce69ad8386e04d730f225c8e474024bd559c3b396b0ab5b
-
Filesize
5.2MB
MD551e7c5f82a16e51453fd4f17535a1843
SHA1a2bf584316a84e9d51185f2b93653d0ba8397220
SHA256e2fc6a22fd818e9a9518dc140e75ce2db711a037197ce6544fb3ecf0cae3c226
SHA512de14ac16c4a1858c3602ef4a5aad08d94cdb0f931e4fb8e1cc869a2c48d30f39f6a0b8afb8093dffcc399be9a634bac63767d430bebbb0fd2104b2f7d54d6a0f
-
Filesize
5.2MB
MD5cc8e8207ecc409255de08cca354c5240
SHA1fa88fce5c7511b171b961370572ae0890b320f19
SHA25627e70a9c3ed17f0a0575dacf1a326c6c1915c530aa21ec829bb96265bac924c2
SHA51283f7e818481c0ab4abe3b7c4fac80dd34e6d30f4fcf6b6be68500c68244c3a4ca4a875e0ebb22b9cd78870081072b689d2f72c286c29d99f38f7e2465dce77bf
-
Filesize
5.2MB
MD56af730ef2db95367db94d1b7e99dfec3
SHA1530e5534bc34afe4c01d4e96b2759da41e95cf3f
SHA256ba1294d9889fcc6865edcf94f1a746aca0beab1c0b36ddc2d4a077d368b4d6a1
SHA512f1cea73c3c3e759dace7b57a231fe802eb06b07a58f87c648862b97e5181903955ca52e381f22a8e3cd62fc2ce3b0fd174c90e0e9003a42dcf9f99d630d02b68
-
Filesize
5.2MB
MD50c42f651c13e6c436f0a24bd97a8695f
SHA1f4df28259e188588396705bc37261a7d4dbbb408
SHA256e9ca123cee5ebfc2047101deecae5622870f3afe5cdc53c8c6ae71bb09ad19e9
SHA5124f13f720d6be2cd635074a1fe92c3835d2d25b91d97fda81a3d60fd2b704ed8b1219ae8ca99b9a285e9e11967cf506a140847228c0ad0ea5980ac60796f70012
-
Filesize
5.2MB
MD5119fdbc426efbcdaeff6add7bf19ca8f
SHA1b6ea8ac300e1a53a4b05e9ea1a74f24fc351228e
SHA2560f795825f6125eef4418a84dec3a9be78d0f4889f9d53c1fac684a9b7a04a302
SHA512763bcfeaad6aca0218c1f12b2af86fb86fb2547e5e64d57b3dcfa5ea039114256bbf76e133360cdb01d03efb1aa915f36acf4dcf60504c07380fe5fdcfda0d0e
-
Filesize
5.2MB
MD5257e5a38bbb79cd4d9fe3f34c96a7d96
SHA157a1182de965e6d590294bebd9a563df6d513e26
SHA256821eb211c26692ec6765cf6a636b237a53e3f7dd08a627c763f03cf11d992d64
SHA512f9a8911b03ec4007271eee86eaabded9083444f4a816c6c0e0dfd5cab5d68c2d01895dc3a74200cc6423ae2c0f3ee0d5c89c5a8c1ff9b0a08b1f0a8e6fb28733
-
Filesize
5.2MB
MD5707a804b407b9b18fc76c74c14a51327
SHA135217e90f205d21751fd1d9f95b52d15987dc1f2
SHA256b671122a5d200f1bd726b902d2eaa9dfbeec7540bead01eed05e621a45db0aa2
SHA512b72fa015515d0d5350c73889b32ea74a6aa99594277c59ae022ebc35dae0867fcce686a96e5ceae22d4e8ebcaa53d15958ee2ce729813255d460aa3d8d329e62
-
Filesize
5.2MB
MD5f1ffd1c96da67e79c4d94056a8a947c2
SHA1c07f775c4f7bee2bddde83c8ce473aff6df94ead
SHA2567dccb723fd22697449571bceed9588f5f9ed62ad6b66795d8c491bebd53e76f3
SHA512f80689ee427c4dba76c6fdb71eaa11dd62e0d3f6822b42c140924bed947e8fe09a19f4465686c28b5e048fb42525b14a2be02ea082cea501f5fb320fecbaff66
-
Filesize
5.2MB
MD56dfa8a0973cf8f21ad24fd0bc7bec6ae
SHA1b7aba4ff65407df812db559cfa401ec3ac824df6
SHA256051a3abd76f1023ffeee8b0af7397846f872951d3ab9991a04a25ba424e52e87
SHA512f6f848dea629f034aefe5266aa0c138c3962967b24460b37f80d394dedfda71da46f7e2524b5249ad55c783ccc8ed67211bf14ec76cc453218dcd742d3c2610c
-
Filesize
5.2MB
MD56b9e3bca061e97f018697a9a8b8ac8c6
SHA15c914e0dc3409ed2f6bf2fd72161a1a78aef45d2
SHA2564986dcf3e39a0f3342b8453f23cbe898be93746c63e75b7ec88db1b9306ec5a4
SHA51273e489d204a9452b32662c0d346c8d70ab9fdb8cf000b0b1e1817988adfe839689990717ee3c34cfd931f3580719eb61dedcf0e44994cdf2d92203dbe2fb2a30
-
Filesize
5.2MB
MD5409b05d7ba8fde49314318791b63e333
SHA1ae4ff2b8d1cd9b3c7c383ed922cecf836c3ef48f
SHA256a51c2436045caaf6577f282b681c4d8e8208af61c14ada2438d432590e7224ba
SHA51262b93763be75c88edee36c4cd96238a66171dccc3df7915ee9b9195143daf1b5040531f27debc3f514c580a21ad97757602bdb3acca98e4bc746dc7fc66f355a
-
Filesize
5.2MB
MD5555fbc6016baddc498d996d67bdefef0
SHA15dab086beab2f7c70e3c24043be17b29a9ce9a63
SHA256caac5dabdf78c7fc27595f4b8c953bd1e3c9fbcd7833be57f2f9ca11136b3c89
SHA51210ba4e0a31b6f0f98b2ec787e40d555aa88db48afb148ecdf82506688e45dd97281e27697af4276a98cfa2bf104001a26a43e15d31172519ae807ff7e7591366
-
Filesize
5.2MB
MD509235b7d5e2d5524d8b37a8849914ea0
SHA1f7e5f39a197ab089837d3eba1b46e196fc540a78
SHA2567fd191f66d85edb824692e35355f5e17ff454a96d8342b3587555ddccb6d9ec1
SHA5120b1538628b485ceb042519d845503b59fc02c62d8d8d466acf9a0ed1cfc046136b89e02ac6f5d3af5abe98d47bcad0581591a98ef38d70b3cb90fa3f9faedd55
-
Filesize
5.2MB
MD50d689616c7b3bac900380e636048dbae
SHA10bf0cce85713004f7903dd55f345749576ce4d9c
SHA256aa3d9b07a3c248910f62c7a98f91c051850e7542318cef52b190f2887d71a5f5
SHA512eead0e94d264cd028f211f4271a16ad9a8b6224130a9cca3eadde7a34c51aa55b2fa5519bf223a14a076c72ff7cfd7c4f3326d160c6ccecae6a8029dc1b3d454
-
Filesize
5.2MB
MD5b7eeeb3b8ebd352d2693538f71b70f86
SHA17c30e9290ec3fd7430260e210352e4389e57a441
SHA256aba7b4ead645b45de4880900349207521f7da56c9e91a818d4bd638405baaa2f
SHA512c0bb55b121dc98914aff23d50eca51a1cdcececabf982d87ee8622da5451001d0b1b8b9d174d9119d6ea37b02307bfb1b5242b5ecc48c7bbf36641bbbb4c07da
-
Filesize
5.2MB
MD59036af00e2efb6f8bbab67e826f9a5a4
SHA10a8162fac365e4cbb0731939be995efee5afc41c
SHA2568f6075c193c7b3904237c8c6e97c1ad46455518a8ffc925974c0695beb8a2853
SHA5121739e9921e89cfc2068b4c488bae77a6882b1c04571ea330021c29a0656925184c16350bfd99a8f5ae4718bcf1686ec3798452e575ff53a6b09c6152fd84b43d
-
Filesize
5.2MB
MD5c36d44dddfa03149fe1085a09084bdf9
SHA11a96afb7b532fd80d056d66a1c041d4d3e981453
SHA25654a0d7177b8cdca4cbf5436060d589b7b3ee3a5ed6cb890ddb1c1d471bb01ac6
SHA5124476d5c0d45475a4f9896774976d186a7bddbfdbc91aa8be2fc562536bab7afe2f620f22621c8b0d4538025bdaf78d4c5f645a3fdd1304dc5425a93039590785
-
Filesize
5.2MB
MD5970d7595b607acc4df01d939a6fa27a2
SHA12aea7687ae0c026bc53dc01fb29c40fc1bcd5409
SHA256910c2e5e412e37788423355fe80df59b2f175e6e0f6c2d40ebf052ad656a97d7
SHA512281a61f9ac4b6f6f45aeaf07cac16bc874ff8a5144b5415d91c07078eb669159b7f766e0ba374315de342ccb973ed83d2a84664e446ba71492977591493d5848
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB