Overview

overview

10

Static

static

10

2024-05-31...ke.exe

windows7-x64

10

2024-05-31...ke.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 23:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
  • Size 6.0MB
  • Sample240531-3z2eaaba59
  • SHA256 517bdbf155a63b02f11654281e68f8914796e5553d732c2806d139c16534ca4e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikexmrig0backdoorminertrojanupx

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 21 IoCs
  • UPX dump on OEP (original entry point) 55 IoCs
  • XMRig Miner payload 59 IoCs
    miner
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\System\dFEBRfh.exe
      C:\Windows\System\dFEBRfh.exe
      2⤵
      • Executes dropped EXE
      PID:2784
    • C:\Windows\System\fyBlLpZ.exe
      C:\Windows\System\fyBlLpZ.exe
      2⤵
      • Executes dropped EXE
      PID:3060
    • C:\Windows\System\cXTyWMC.exe
      C:\Windows\System\cXTyWMC.exe
      2⤵
      • Executes dropped EXE
      PID:2644
    • C:\Windows\System\gpLXSLC.exe
      C:\Windows\System\gpLXSLC.exe
      2⤵
      • Executes dropped EXE
      PID:2808
    • C:\Windows\System\WLGATLk.exe
      C:\Windows\System\WLGATLk.exe
      2⤵
      • Executes dropped EXE
      PID:1196
    • C:\Windows\System\laMfqnS.exe
      C:\Windows\System\laMfqnS.exe
      2⤵
      • Executes dropped EXE
      PID:2220
    • C:\Windows\System\kyRwnWa.exe
      C:\Windows\System\kyRwnWa.exe
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\System\RwMQdtB.exe
      C:\Windows\System\RwMQdtB.exe
      2⤵
      • Executes dropped EXE
      PID:2464
    • C:\Windows\System\xABfdAN.exe
      C:\Windows\System\xABfdAN.exe
      2⤵
      • Executes dropped EXE
      PID:2720
    • C:\Windows\System\KppMgSI.exe
      C:\Windows\System\KppMgSI.exe
      2⤵
      • Executes dropped EXE
      PID:1556
    • C:\Windows\System\YEriBpN.exe
      C:\Windows\System\YEriBpN.exe
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\System\OxOALOZ.exe
      C:\Windows\System\OxOALOZ.exe
      2⤵
      • Executes dropped EXE
      PID:2608
    • C:\Windows\System\qlazRkv.exe
      C:\Windows\System\qlazRkv.exe
      2⤵
      • Executes dropped EXE
      PID:2612
    • C:\Windows\System\VAeHHSt.exe
      C:\Windows\System\VAeHHSt.exe
      2⤵
      • Executes dropped EXE
      PID:1884
    • C:\Windows\System\oFPmnpL.exe
      C:\Windows\System\oFPmnpL.exe
      2⤵
      • Executes dropped EXE
      PID:1900
    • C:\Windows\System\XsIgxcK.exe
      C:\Windows\System\XsIgxcK.exe
      2⤵
      • Executes dropped EXE
      PID:1888
    • C:\Windows\System\dFFCQSE.exe
      C:\Windows\System\dFFCQSE.exe
      2⤵
      • Executes dropped EXE
      PID:2280
    • C:\Windows\System\uvaAMfy.exe
      C:\Windows\System\uvaAMfy.exe
      2⤵
      • Executes dropped EXE
      PID:2156
    • C:\Windows\System\oeDSFGH.exe
      C:\Windows\System\oeDSFGH.exe
      2⤵
      • Executes dropped EXE
      PID:1568
    • C:\Windows\System\lyRuCbx.exe
      C:\Windows\System\lyRuCbx.exe
      2⤵
      • Executes dropped EXE
      PID:2136
    • C:\Windows\System\fsqrtwe.exe
      C:\Windows\System\fsqrtwe.exe
      2⤵
      • Executes dropped EXE
      PID:640

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OxOALOZ.exe
        • Path C:\Windows\system\OxOALOZ.exe
        • Size 6.0MB
        • SHA256 0c6fb2a8639a5a33a9562818bdc9826b4fff4b3ce55f7837072ca26a23edb92f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RwMQdtB.exe
        • Path C:\Windows\system\RwMQdtB.exe
        • Size 6.0MB
        • SHA256 71d2e571118efe4310f282107cabbca77bd5a9c23416955e90c4dc0ce3f7923f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VAeHHSt.exe
        • Path C:\Windows\system\VAeHHSt.exe
        • Size 6.0MB
        • SHA256 197109dc8f1f5b085b5aa8669d58d1b1a2234f5343ae7a07a379cfed7119610d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XsIgxcK.exe
        • Path C:\Windows\system\XsIgxcK.exe
        • Size 6.0MB
        • SHA256 9fd70bc6f999a0b16f149050cacf1fe0b8c042d75eba1cc1dbbe562321338abc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        YEriBpN.exe
        • Path C:\Windows\system\YEriBpN.exe
        • Size 6.0MB
        • SHA256 7870e8b79c5ee6403a11a4eac6282d4a6878491aef5acc1eedb06f67bceb59d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cXTyWMC.exe
        • Path C:\Windows\system\cXTyWMC.exe
        • Size 6.0MB
        • SHA256 291fb613d6dd04efa6dc6618e0aa1d5a7e57f396c019539e091c5fb23cc5964d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dFFCQSE.exe
        • Path C:\Windows\system\dFFCQSE.exe
        • Size 6.0MB
        • SHA256 f77662080ad7b0315303f32c1150e947325d378e113386a146cc505153c5bcc5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gpLXSLC.exe
        • Path C:\Windows\system\gpLXSLC.exe
        • Size 6.0MB
        • SHA256 01af4bbb28b57f0e7c8e2819ebd8cf424e0598875368e22bc4bd1816666551bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kyRwnWa.exe
        • Path C:\Windows\system\kyRwnWa.exe
        • Size 6.0MB
        • SHA256 9418431ca932625a2c6344438fbdd76d7e62686f787100f08a84c423c0681cb5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        laMfqnS.exe
        • Path C:\Windows\system\laMfqnS.exe
        • Size 6.0MB
        • SHA256 0683f0eda1e25fd55a05987a46d047446a9af52c56f30e78d2764237462dac66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lyRuCbx.exe
        • Path C:\Windows\system\lyRuCbx.exe
        • Size 6.0MB
        • SHA256 d0d3806673db1cbf134a8c6d4a12a037f70aa9e50b03c236276d94d9acb5c379
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uvaAMfy.exe
        • Path C:\Windows\system\uvaAMfy.exe
        • Size 6.0MB
        • SHA256 0df446d777646913f6f56de13d99f6300f32426e8d18456545e1c41406fdc680
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xABfdAN.exe
        • Path C:\Windows\system\xABfdAN.exe
        • Size 6.0MB
        • SHA256 943714df8518f1d7aec59303e08cf2ccdf75f74c720f1c19d975508988cbcf2c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KppMgSI.exe
        • Path \Windows\system\KppMgSI.exe
        • Size 6.0MB
        • SHA256 d0eb6465b3b9616ed58f5270d929a0725e0b88b24ccfbad9d60518c6411ee8e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WLGATLk.exe
        • Path \Windows\system\WLGATLk.exe
        • Size 6.0MB
        • SHA256 84f975d576dc1642e6ade0e736a03b62b6bf295fb9e76d3ae2de5a40758570b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dFEBRfh.exe
        • Path \Windows\system\dFEBRfh.exe
        • Size 6.0MB
        • SHA256 423cc6f831770c6b373a87189d2b7afc64ddb64075f2ee83ef0b3dd47651512f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fsqrtwe.exe
        • Path \Windows\system\fsqrtwe.exe
        • Size 6.0MB
        • SHA256 dc3aa47cae42fb7146628523c9afbdd0f7853143a8db748403244752b4d9aa3f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fyBlLpZ.exe
        • Path \Windows\system\fyBlLpZ.exe
        • Size 6.0MB
        • SHA256 199fbd759e5557f3829bf09a742121204b97483a88d99bf1411458f4195dac46
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        oFPmnpL.exe
        • Path \Windows\system\oFPmnpL.exe
        • Size 6.0MB
        • SHA256 1547c36a0d73dd1c3d247c8794890eb620c1613de30f225b030c6bde2b6aad43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        oeDSFGH.exe
        • Path \Windows\system\oeDSFGH.exe
        • Size 6.0MB
        • SHA256 e6fd55106d39b0f88c489b9e81719497493ddba0f57a82373ed6e192cd0dedc2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        qlazRkv.exe
        • Path \Windows\system\qlazRkv.exe
        • Size 6.0MB
        • SHA256 85dc305434f9c439f48ab278dde32023879246275c2eb2417d5d2a2a34f35c8d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1196-42-0x000000013FB60000-0x000000013FEB4000-memory.dmp
        Download

        memory/1196-147-0x000000013FB60000-0x000000013FEB4000-memory.dmp
        Download

        memory/1356-153-0x000000013F210000-0x000000013F564000-memory.dmp
        Download

        memory/1356-79-0x000000013F210000-0x000000013F564000-memory.dmp
        Download

        memory/1556-152-0x000000013F020000-0x000000013F374000-memory.dmp
        Download

        memory/1556-72-0x000000013F020000-0x000000013F374000-memory.dmp
        Download

        memory/1884-108-0x000000013FB20000-0x000000013FE74000-memory.dmp
        Download

        memory/1884-156-0x000000013FB20000-0x000000013FE74000-memory.dmp
        Download

        memory/2220-46-0x000000013F800000-0x000000013FB54000-memory.dmp
        Download

        memory/2220-148-0x000000013F800000-0x000000013FB54000-memory.dmp
        Download

        memory/2220-100-0x000000013F800000-0x000000013FB54000-memory.dmp
        Download

        memory/2464-58-0x000000013F370000-0x000000013F6C4000-memory.dmp
        Download

        memory/2464-150-0x000000013F370000-0x000000013F6C4000-memory.dmp
        Download

        memory/2588-51-0x000000013FFE0000-0x0000000140334000-memory.dmp
        Download

        memory/2588-149-0x000000013FFE0000-0x0000000140334000-memory.dmp
        Download

        memory/2608-93-0x000000013F7C0000-0x000000013FB14000-memory.dmp
        Download

        memory/2608-154-0x000000013F7C0000-0x000000013FB14000-memory.dmp
        Download

        memory/2612-94-0x000000013F6E0000-0x000000013FA34000-memory.dmp
        Download

        memory/2612-155-0x000000013F6E0000-0x000000013FA34000-memory.dmp
        Download

        memory/2644-23-0x000000013FE30000-0x0000000140184000-memory.dmp
        Download

        memory/2644-145-0x000000013FE30000-0x0000000140184000-memory.dmp
        Download

        memory/2720-151-0x000000013F590000-0x000000013F8E4000-memory.dmp
        Download

        memory/2720-65-0x000000013F590000-0x000000013F8E4000-memory.dmp
        Download

        memory/2784-56-0x000000013F350000-0x000000013F6A4000-memory.dmp
        Download

        memory/2784-9-0x000000013F350000-0x000000013F6A4000-memory.dmp
        Download

        memory/2784-143-0x000000013F350000-0x000000013F6A4000-memory.dmp
        Download

        memory/2808-146-0x000000013F7E0000-0x000000013FB34000-memory.dmp
        Download

        memory/2808-30-0x000000013F7E0000-0x000000013FB34000-memory.dmp
        Download

        memory/2808-85-0x000000013F7E0000-0x000000013FB34000-memory.dmp
        Download

        memory/2860-21-0x000000013FE30000-0x0000000140184000-memory.dmp
        Download

        memory/2860-28-0x000000013F7E0000-0x000000013FB34000-memory.dmp
        Download

        memory/2860-101-0x000000013FB20000-0x000000013FE74000-memory.dmp
        Download

        memory/2860-64-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2860-138-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2860-139-0x000000013F020000-0x000000013F374000-memory.dmp
        Download

        memory/2860-140-0x000000013F7C0000-0x000000013FB14000-memory.dmp
        Download

        memory/2860-141-0x000000013FB20000-0x000000013FE74000-memory.dmp
        Download

        memory/2860-142-0x000000013FCF0000-0x0000000140044000-memory.dmp
        Download

        memory/2860-116-0x000000013FCF0000-0x0000000140044000-memory.dmp
        Download

        memory/2860-1-0x00000000000F0000-0x0000000000100000-memory.dmp
        Download

        memory/2860-71-0x000000013F020000-0x000000013F374000-memory.dmp
        Download

        memory/2860-49-0x000000013FFE0000-0x0000000140334000-memory.dmp
        Download

        memory/2860-14-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2860-47-0x000000013F800000-0x000000013FB54000-memory.dmp
        Download

        memory/2860-0-0x000000013F3E0000-0x000000013F734000-memory.dmp
        Download

        memory/2860-90-0x000000013F7C0000-0x000000013FB14000-memory.dmp
        Download

        memory/2860-86-0x000000013FB60000-0x000000013FEB4000-memory.dmp
        Download

        memory/2860-39-0x000000013F3E0000-0x000000013F734000-memory.dmp
        Download

        memory/2860-6-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2860-78-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/3060-16-0x000000013F510000-0x000000013F864000-memory.dmp
        Download

        memory/3060-144-0x000000013F510000-0x000000013F864000-memory.dmp
        Download