Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30/05/2024, 16:26
General
-
Target
2024-05-30_1f4307c0d945b94fedcef9b2e82c5f5e_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
1f4307c0d945b94fedcef9b2e82c5f5e
-
SHA1
1344bc8a1034956c1b63e22e1e525667c4d24d9f
-
SHA256
5a8e6aa5b19df2c32cb52d99296ba56392cf999865ac86aee7131882713f07cc
-
SHA512
f403f0a51ef811e1981b72b048db528b5c2a0f56a4578b7c787126ca5b996dcba012eb204e6e5a950777ccfa8d8bba03e38b535f54f272cca7fa2e66d31f40b0
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_1f4307c0d945b94fedcef9b2e82c5f5e_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_1f4307c0d945b94fedcef9b2e82c5f5e_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xHuRZVG.exeC:\Windows\System\xHuRZVG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MtIoWrp.exeC:\Windows\System\MtIoWrp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hZPLrMQ.exeC:\Windows\System\hZPLrMQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwNdiZx.exeC:\Windows\System\lwNdiZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WyLoawo.exeC:\Windows\System\WyLoawo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAsuwsN.exeC:\Windows\System\wAsuwsN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RlUnUxX.exeC:\Windows\System\RlUnUxX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SqJphCS.exeC:\Windows\System\SqJphCS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lokocvv.exeC:\Windows\System\lokocvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WWjewwM.exeC:\Windows\System\WWjewwM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgzcmVK.exeC:\Windows\System\HgzcmVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iphUnIh.exeC:\Windows\System\iphUnIh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVzhCMB.exeC:\Windows\System\EVzhCMB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXVeenH.exeC:\Windows\System\gXVeenH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcGbBhl.exeC:\Windows\System\KcGbBhl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsuqwWC.exeC:\Windows\System\xsuqwWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYuuBGk.exeC:\Windows\System\xYuuBGk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJtcRYY.exeC:\Windows\System\SJtcRYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXmUnzj.exeC:\Windows\System\zXmUnzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkjErld.exeC:\Windows\System\fkjErld.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kdkkxFW.exeC:\Windows\System\kdkkxFW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD506ef8f3c5a028c405a68c9e66156ba3d
SHA1e2d3828654b8eed82ef8b3065ea2dae575549280
SHA256e403d49abba19d52b65b68de24e96e1cef825f3b9bac20dd5599b1c6a9a8c942
SHA51273dbcd945d6a6ebde9fb720050f4604ef8014868645ca2ed76cd12004d2cc47891ffe58a639804c09cd0b26c044549469df9e3dc6b3a14232beaf116836aefd1
-
Filesize
5.9MB
MD558148a2e07a536a6f4c426afa1dbc8cf
SHA1c00c81f46dd10c2de81548473f7e99e4601279d5
SHA25646d238168cb865518d2f5c77f82d4ff5e83075c7ebfc9daa2ad45648d86e2504
SHA512e95e2ade8d6387c66cd8f96d23dac73028403ff6c4026a8ae1ee1d7b70c0a67969d356ebff189afb3dc336277c99c44bd67fc1041e9a7c04edf2037e8b23145f
-
Filesize
5.9MB
MD503076388e49f2eec9e6dc9a65d86a5be
SHA10e072b00da07ddbbb2deacf5441467518a41eb41
SHA2561142c693d7fffb418bb52165aed0a0a4e935d65aa81442950dd17be16bffd4dc
SHA51236de32b45121c6c567daf41659a8557bddd2b866a9fe9478ace355261ee97362db8efe8a6192b1e44e3ef59f851c63f33dd53c1079400107ada2697fe9e68811
-
Filesize
5.9MB
MD52ba6939302207832149277b3869d7a57
SHA12af9b484bd6c917b0c3c0d24f570b8799d39758e
SHA256064ae8e3b448c3d8f940c08ce14cba01bbe34d14e2bcfc6abefed424ac1c15a3
SHA512767533e6d4283341e12acd923944b72ebba6f79d52bdda590b3f4449e7e1182cb39284b0a5db301f7f5817a5df5b4c2e61867281cb3dd4285ba71a02fd52012c
-
Filesize
5.9MB
MD54af04343565419e92abe8c65ddd2aa53
SHA11eb9cb8f5462ad17947e385ec31d0ba6b3564727
SHA256d157c63d7872f4aa33cecfaa44fac7e30af6d2dd510556bdd168d7e59073be8b
SHA512679c18680e67ec75ade6c30584efefeb172b65de11fb8cf15670b98fa9bdfd3257223e3a520e6552a599b42643b362b6630147b09996505c9755560555355a22
-
Filesize
5.9MB
MD55b2593c943e825f075fbad1d5f0556df
SHA13689e5dafb7ef6087ceabf470de0398ee3416d1a
SHA256a76cc74157dc336d037e15c168b9e810c6d6d8225d74fb1cf48b25d62c5f0f68
SHA512ff736bd58ce084ade8641b3b7e5c12aa52e6d1d1babaa4cba100ed5744238bf2a80b04b1337b414e23f0fd8eba679fa3ddc566e64565abe98a6b8058a076ceb4
-
Filesize
5.9MB
MD501d1cb8f646e38d40726a52f47115c5d
SHA1a0bb6d76e1f6c130b3e3dac1609b5e3bc9602b8d
SHA25689fd91a4457f0e5d97c9d21e4d62f2eb0d32f00ff0896d803529e9d558e2e35d
SHA5125fcd7d25f419d17981032fe1b6d7c849148d0657bb09824fda77cffe7188f266905d6f98d20a6e13c325bac237443fb1ff61d5f6905f03b5a1fe0ab998140779
-
Filesize
5.9MB
MD528ee7a26b27d3458af8a96a58a890946
SHA19642f2e8508f36491049e92d6b9bf9d5efed23c2
SHA256d790191b7e60ea17fcf45a06532d4c8bef5f92e1015a09e11f30a9eb05657e3c
SHA512d26ed424c732126ef9103cbbf622b905f8de8b138360e84f0cb5c2c976bd4d5fe9485d1640d9cd61473c6ce3bc05eee3e3c4075f1245df21a808b2e7e10faf28
-
Filesize
5.9MB
MD5cb214b328034f2f55a6cb97c67a9d451
SHA130774f5e658fa54eeae4841de17dc0ddca509794
SHA256f9f53f75981f38e04d65832195b6070d61e9d0ed7fd7416840b4ba9f69b5fc28
SHA5125a8a3b037fec3bccd295bc1ab774ed3d1ac8ebe7497b356d9579ea5892a9e320299bd825f0dafa3c641c96a2a0f9cf857189eeff706ac92e1d2656a0b0e538b9
-
Filesize
5.9MB
MD5588c5c22bb80400802c8d43c64f83c4c
SHA18801147c123dd54b9575482cca62ec1d9457fc78
SHA256fe1e0bcffd1a91b80d4d270f608f6c54accc854083a140c9b77b75f4dee9df99
SHA512f977897bea406143ec3641b485e3d88e34d70d73930a750cce3476ac8b5fdeb39ab65c58d3b0217ed42f489bab0874035299fc27650ad5d9d3813d0a618dda94
-
Filesize
5.9MB
MD5d856b2fcec35ebd6da060af691d8ab41
SHA1d98c771665aa028e5deb609c048b66db28b5c785
SHA2561804dce37496db106545680d39d63aed19c56c282852eb2ba432dcf1a751217f
SHA5127bef74051d0727e680841760840c78d7b2ed66e71c54ce2ffe32b789f05c59e480194e8a727e55d811aee622b3407db50b0d92a514ef022bcbac397e1a4ff0fa
-
Filesize
5.9MB
MD5e8985d99e649825fc6b2d8a466724bef
SHA1c4419e2591afc1cac854b08b22e0b4906dd5ba21
SHA256a63aa1f041b3c4957d453a58fefe2420344d32bd93eeaa9b7d95e47c3c0737e0
SHA51240ad797c59dee6c7fb91549dc9ee6d98ecb7249a1c7a1790e2d9986124f9d47ecb5c30c3f4ce4451c6ebb49ee3750ee95db7289ed489a47ecbded4a7b5447c49
-
Filesize
5.9MB
MD5b7e8e1620c983786df9e957c4e353e8e
SHA11c434240882740be72bc23de9a1a7e13469d3428
SHA25689e9c64a5df64484c679d4b66973c73d2601d5fc291fdc50c06d91224f5e402f
SHA5126875ea0c0959101096bda76a410b2756503eb24ecffd2af9db7f82edda11ec0410905da6085ac21f2af0e80879b1b837224d7464c0b6d9ccef0a6804ce2fc7ec
-
Filesize
5.9MB
MD5c75071930137ecdac8b45d30abd526dd
SHA1951900742b829b409ff54d607a5a74a6effd59f6
SHA2560d4a92d2d5263846e557182c1c73f0f4612e51d49bd1bae8b10edc5a95c7bbb3
SHA5121db79fb1a82b4458796fc816410eaf8392b47f167c85b5528409966db440af027c63c16265013b56558db29fa8161f88b933883cea21e4a3e055b388c1e85cb3
-
Filesize
5.9MB
MD5c8efd9462aafdabc3c851bb0ec76ca06
SHA1bc5981300c65931554fc79258debfae119f9e4bc
SHA256e1da433a8d0d16880481f5f4cb92b0ea71d85c95a8e2d3165e24b03e22c92fbf
SHA512758baa07bf5b88953c8e03abca3301f4c35e14bb7757e689fbef5881c094113c3575af1dc00a209ebb9a36365dd05ae3c6db5f46188dcca7764521ef4277b52d
-
Filesize
5.9MB
MD57bc0fe1cdf00f45cba9022fd34fc19b7
SHA1a19ebe04b18fdf18633d35ed07b2ceb3e74218f0
SHA2565cce35ebe2fd2a95f91a2e352ce8fc7050ad5b614bc86880ef500dcb4243540a
SHA512760f823b188359d0e4a81aef7abc970b328eba126775df878728b828cd89f71bf6410209fb88af8ade185bada8772bc9dd20aeea42ab6e8edd3f3e14eda58695
-
Filesize
5.9MB
MD586c393635594049e390b7ad53dbf2aff
SHA13f8a36eae7e7c31ec3786da9d5ee62e179103159
SHA25652647c495873001b3a4becafcd80c5893fc250e34e8f00f7596c9c6808fa9edf
SHA512f9e19c12ce47dc53d5493457d3f1a67525618caf2d457d463076188f95c0013cd6940d787e810bbbd6e5dbea4eab9b5fa47232e9e05b5ec1384b2c0bb0de7634
-
Filesize
5.9MB
MD55b97d0268e086929d39f3bb9b5a3cfa5
SHA1b80ef34b982817223e548a0eea4f84ada93bdb3d
SHA256787914db64d504caec0464215ad261f28094ee46ea73308309e197fc84938c1c
SHA5128baa7b3f5e3ff1bc4e9892026dc489f71791c83a96cede8de07806fc141796537d380b2ce8f4894f90f19b724a72731eb01ae000c6690ac6f4fa7bb5af0965d4
-
Filesize
5.9MB
MD5e2a415459557a3a56065d38682b716fd
SHA1281137370043b54a2996678b803307cd53ec8364
SHA2563aa472236a2ea16e58e6311fcd8e1b8c5e948b094f1d17f3b7b4b78325682529
SHA512f38711a54f188cdf659c8cf2a9dd1b7f64e954cf146fac4cbd0fce6ef17f753a0ee070e1ccc2c2defce5f2c9ce2a3b42d6792f964ad5d6be2f4e12ae4dda21f9
-
Filesize
5.9MB
MD59bc25054e45ed5bfde8fc3befd9fb380
SHA1753389e5170ea1b2309b9d7586885622cb94f5b5
SHA256a0791b8049ceec0710e94028f8c92573fc07c4049096e41c71b1a6b51504f159
SHA512d55a7b6ea676416b0e72abcf7ff0afcd60a8f7f93388d303e7584bf25a88aec72d55221d0a60dae51e498a43e8fbf87443088d061c3e30ccbe306c84b2894a77
-
Filesize
5.9MB
MD574a858a70b678ed015e219ec3b6eaf8d
SHA109f1248bf9cf26c1212e08b4fc4b838cf6cc8af2
SHA256f148aca265af23eae87303e464d3713ef41da0ab25a078a2413af6a8eae0e95e
SHA5123e92f382cce98b89d0fa588ef1df804c9ff428d1e52daaef1c426e483159da6b9433ff0b3ae5d23ae2d8d25ba438b3c1f4e6469f24934b90c694c4768badbe41
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB