Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30-05-2024 09:34
General
-
Target
2024-05-30_7b58ae31b28cdcf1f61fe13af1dab6e1_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
7b58ae31b28cdcf1f61fe13af1dab6e1
-
SHA1
007bd9060f30cf84c40a88eaf19686021c6dbf2f
-
SHA256
b75cd532c50dcb60baec52f6cedaca20ac30384a867a56ca5b7c874fd2a11ecc
-
SHA512
bee8024c707e4c55b1fd440d23c254a33050049632c2f69427e2cf66a171d6880233ab3da080c671815603e3207edb9bf7e22928fe2ff0c9c21202aa30b224e1
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_7b58ae31b28cdcf1f61fe13af1dab6e1_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_7b58ae31b28cdcf1f61fe13af1dab6e1_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ShkJORX.exeC:\Windows\System\ShkJORX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\STompFf.exeC:\Windows\System\STompFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NTWMHnO.exeC:\Windows\System\NTWMHnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\avmEILp.exeC:\Windows\System\avmEILp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPdruSp.exeC:\Windows\System\kPdruSp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dZNbGap.exeC:\Windows\System\dZNbGap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojGRNOP.exeC:\Windows\System\ojGRNOP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JeUjfQr.exeC:\Windows\System\JeUjfQr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFbUsdU.exeC:\Windows\System\tFbUsdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFtPGNK.exeC:\Windows\System\dFtPGNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tewTPUj.exeC:\Windows\System\tewTPUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBeQdrT.exeC:\Windows\System\ZBeQdrT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qkpJCoa.exeC:\Windows\System\qkpJCoa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOpJMjz.exeC:\Windows\System\iOpJMjz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXrqBgc.exeC:\Windows\System\wXrqBgc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOIUPzJ.exeC:\Windows\System\fOIUPzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wisnVwH.exeC:\Windows\System\wisnVwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgdPyzZ.exeC:\Windows\System\lgdPyzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nThjuiR.exeC:\Windows\System\nThjuiR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQFgAfj.exeC:\Windows\System\mQFgAfj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JDLGERE.exeC:\Windows\System\JDLGERE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e5fbd52da7ecb2111908c3d9537d4471
SHA1ec7381a20fa6380d5cb8229fbcdc0f4933655473
SHA256de583db6a9ae0183526ff5993feff6ca87cbf01201b4a791b396a3505ade1d84
SHA512f5bea2543635e05956321ff1a8be1501b9191e290de467970005e29e0b6c038fd2b92f385d90e5159ac0940c3888290da41e86a4e2ba336023dc3931a8e0ec12
-
Filesize
5.2MB
MD5bdbf24eb091efb2a04a3a00f6643daf9
SHA1a6cee34328a6f788e2408a5e7c270f14260a01a9
SHA256350c267ea4d59d3333c4078ae377cda5249fa8e6fd9059346929b65287bbbe1d
SHA512714591e586f640be1758b40353f398cb833a9d2d5bebf6105116a1e906e12057531a24c9e81f9cc73963b8c8e1f3b3d0197b1ce3ac92dd8b633e0a6aa06acc35
-
Filesize
5.2MB
MD5078ae1879b58d400f5b7b25b40441a2c
SHA180a50fdb8f32d39f1e1d54593d74966f2f534618
SHA2562e66d88c7fe780177d58874599e726cf7f0be7dd51aebbf7efd44be8555149d1
SHA5122b9272f3b1504bbe0f5052be9a9f19278836412b8cf2062105d5413e443d80c1a323d196514455d17207c754c103ef0fe7cc8a5fee9558d2f699f1a6fbb82b64
-
Filesize
5.2MB
MD5e3f55f1b5a040896d8356725bb333d71
SHA1a57cce631893d0e25267402869808645051c7547
SHA2561b1eeedb59f0fc58a2afea9b299e6b79716544ea21c80726ce5a18ecb1148946
SHA512aa8fbded958d0288779d06feffce64adab1a23ef07b8d5e080c989405ae43dd5aff791049d4263497d761f2ed94a37104dfc758a0db40ba6e1e93bc28871fb2d
-
Filesize
5.2MB
MD53b1d2cd30ddf48ffda3009fe874393f0
SHA1cbc1822e93c025f143d0698bd6903dd152a767db
SHA256281b5a7f0260a1ddc5deb79bb13d191a7cd1a2cb299cdae1165b59ebe097c8a6
SHA512e166b1667b7eda187fdfba73bd221c17457a27968a97b5e074aa3e45cf5d2317195f81e45a6dc51ce4a1cba40906c2939d1be682f82e4c4317dc527b5b9e7c88
-
Filesize
5.2MB
MD50785fea7dd66dec2130c2ec5a7ca1f70
SHA13b3ef960d136b16d624fbc4d73e2fc6ba4169ab1
SHA2561b537091e861936bcb7bd6f723b9509811900cdbc6a4546f1af544e30197fea3
SHA51201359c53bf6f0e1e69197d10b39aa9051f5957144b56ec99036b5e788e14a35df85e192886ef9874cc2c55686ccb50d67695131ee4fc1b8e0bcaf168eba8d49e
-
Filesize
5.2MB
MD5cf1479e784ee45ba0954cac5c2b8ab25
SHA1a51c6c267321c22b6aa29b0ef859eeb6ac27822d
SHA256c28fa468cbc09569715bdc1b01f66899ce9acf7247af6c627b6a054f1384a287
SHA512b09e8ea21aebaa62214fae348ba74d1ed97ece6e31f4a1396a443f1b18d5b15bd3fc3a18475f4d261823e654e000f5c260fb9fffd0a7e656e57f3ace08a9345d
-
Filesize
5.2MB
MD5834fd0f948e3730cb7fc46a4c7170c7a
SHA182de6056c70a00c5c552509256fab052c27de379
SHA2569a1c3dfcacb8a87992e592c3b78692f707a9ecb86e6fedee8fed940b655146f7
SHA512dc7306f4a03db0450da9261e567ec10bef1468ee125eeaa43f351e64c87bc536f4723733481170e6343642d4fe6119a75ba214b7cc831617a096d364bf5d9ef3
-
Filesize
5.2MB
MD5ad650abef55b7591aba7c5b5aae11b59
SHA133b4af0959a777b6bf424777d40fe56552ae6025
SHA256f1d8fdf4777bd6fa06834b7e5733dc3feee8c2d94425fc4633506fca426aafb7
SHA512cb38586e3d4738399fa79b1ecbbcd7da9f23af466561cebf04ff9fce539648f190feb2b6804f49dc588e89728cde87eeacbb9ff54a7d04b639578742ae51cf9c
-
Filesize
5.2MB
MD51483ef5dec1fa44cbda3ff2566120b70
SHA1f4b0622254c0a89a6b8113ef67eeb5de9d8dd65d
SHA256d3a39f3566a88d95217c62fc67c5f6424a28ec7c781b6a40dca983f0920f62c4
SHA512820206ab20bdabe193cf513b34695a95650f8ebf9c3c2e34f569d67e1a8c9f9d1243b324068246b1015256274c0a74bceffda3829d2b320655b361e9eb49b8b3
-
Filesize
5.2MB
MD554f49817441783f43999cd59e302148c
SHA1fb724210f7b8e1a6484cd18adf3bbd2fa8c3c78f
SHA25627514bd162d31aa80bde7d30cd90b11621d1e01e075f53a3dd9b8433b0b7e167
SHA512e1c34eafd2a3335725ecdf5acb4d622c1d0bbaef74fed794ed2ce98a64387afef7451a4880564fa270680d51307f7456a185ee50c8f9162ab86fb8a1798082df
-
Filesize
5.2MB
MD555cf3231dea085eb0443e000a26fe44b
SHA100dc401f5dcafcbe9c962f9ce99db431dd183d69
SHA256c37c7bb34d4aab390c2887ca80251a349d0a6e3d52d3bb34dbd8b711405988d6
SHA5128e56e51442175e9c6d329c5951b0fd21a40e51076211ebd249cfbf07ea92ca8164e9333d523ae0d5fc15d79eb535cc038e1b18676a6fe679c31fc19eb9b4dff9
-
Filesize
5.2MB
MD51c2eab634874e0a1b0dcd5a19cd0f87c
SHA19bbc2c227f64f953fa97ef1cdc342c04fd39ae87
SHA25633a398f9ce8f6d6589c3fa79d4c8d29d620481111b54fb109abed7ac8288b6da
SHA51214fb0537a534a9a7c354f44c577291a35459b04ceb7c85b4f0476a4db12930e043964b808eeb69c8497ac7cba60b5002c232935583dcf7dc67e14838a9586dcb
-
Filesize
5.2MB
MD58759b45b815fb788ea0cbae73170753a
SHA1a80ba893ac161653a5bb4444d92b02d702796fa7
SHA2569c6c6894bccb7001aa471c1e5e7c55cc64c6e6e797344a1a4d21b791de170df4
SHA51266883932767816a6fad72d8667f66224abfad2d44f872c56e3e3c6325d60c3dc15488b26ecee0f5a33a0cbb39025e9e1c92edcaead2f9c3c7ef0c3bb9c711d0b
-
Filesize
5.2MB
MD5a95f23ebad58c58de7809a72cacc34b1
SHA1ce55b4ae53d5a26199586533036be7ca5679b825
SHA2568a3ba6e694b07ba109e5ad8fa6849b19bbfb250d063575ac1792f92fb21d0ce4
SHA512318d1356b2b0963578e2bd15bd3b3557ed04edb11bf57a92d0b07b617211d2736ff50f3edc936a90afc96433d894deef14a8dbc06d7b2a8aaaf160497404a0a0
-
Filesize
5.2MB
MD59b72fb1ad6709dafcc2bc107cbaa0987
SHA18e282ebe529ba4d3f8926023af17155952461765
SHA2568888a1198d48f83bf813f8a11613e2ed25748b4ebb60e0210cac7c672ad5649e
SHA512a616ea5e99d9ec8ee00a1af083f493d3f928ddbaf924ad8cb2d8761832eecaf5675cb06b3310151349b442e51ef114d876a84e02c3fa85c88c3dd81eaf171955
-
Filesize
5.2MB
MD59ea4418f412d7e1420ee0708f2693478
SHA16f7c4a094350df13446394182c9af9a74a1342ed
SHA256dcd04d07fa73a3a2379e2356fc1d2d8448b981dffec2403dba6d01d3d7f4456a
SHA5120b08e600349d616f77e601fb68625ad4ff282c9d4c7d0f681e5ba1354b972a2d762e62dffbcaa3b85596cbc503cdef5f91895e82df73f79df93f30c24a561129
-
Filesize
5.2MB
MD5843baa6df3ccf6ad8019d388cec46e36
SHA157eba8f672fe7ed5ab804518009cf5f09dda5cd2
SHA256fafeabc6f900ce05205e737d86bdfc2d8f8009e1880d4a10e9f77eda7091d04e
SHA5127f99aaf746f6129ac3bd853bcabadf6e27576a5eb8f51d60f7ea3f95b44e480465ef3c89762078a17e944fd1c03b9c26d4819ad05f64ffdc5bfb574cdd18e315
-
Filesize
5.2MB
MD58231afc5a3207995276d2ea432a743e3
SHA155cbb303c874a357f4539b09fedb24ee02d308b4
SHA256878b624bad8f5ec4b2d3b4fc9bb1fa974a0569971f1d2559b11a40c5e353111c
SHA512d7e8311cbb037c187444cda1797b78c9747d251ad1497e3cda32d16c945517161e699ef8b6adbea82c934dca3b23577a69459583141faadf78a5ecbe940f7ea6
-
Filesize
5.2MB
MD507c88d1c9ca4b2a5135a74881fa47223
SHA1c62b183b5bae662d3e8d8ee2840785e1e2c19ede
SHA2565fe18ae6e3937cf6cf5556c3467991147b76ba0988612495b652b81f6aadd96c
SHA5122bf4ca4f42f4ba84906900a05b5011c8684668989785ffd78a5f27083230e9fc30023e09f8eb58086be0e8f4d8061507eec40b8d4426adcc2806568294904422
-
Filesize
5.2MB
MD5b79b91abe32d09a789e21c2721cc4963
SHA133d839f41bfe3748df6f5bd3870d0eb015e16777
SHA256fc355971d7a57721494120a5a7c1d72d2ff1e5ec24f31280fbc624de59f10116
SHA512437b0a00c427879421e5992dfbc936e7ffa82debe1db45e9aab649e51da495075b64148fee65efe4de503fb8b03e4a2ad6ec1e3af315f7e3296a51a8e9036102
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB