Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/05/2024, 00:53
General
-
Target
2024-05-31_53236d5c4a4bc31c3b8defb5efb4e698_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
53236d5c4a4bc31c3b8defb5efb4e698
-
SHA1
e680308add6b4d379e856ff00fc2496f47036abe
-
SHA256
033f2ba7805eb7ceee314469c6933c7e26b2a9422a8828057785a579b4bdca02
-
SHA512
74809affda452d9a6e0a9eb13727a96e113ff3cfac1d540f68a8d0efa28cb1cdeabe17c6205d21c1307a5f5431b121ddf99028f7b91ac08a662cb1d00eeb4085
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:T+856utgpPF8u/7f
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 56 IoCs
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_53236d5c4a4bc31c3b8defb5efb4e698_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_53236d5c4a4bc31c3b8defb5efb4e698_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vhgKvHP.exeC:\Windows\System\vhgKvHP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jaORtHh.exeC:\Windows\System\jaORtHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMterOz.exeC:\Windows\System\jMterOz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxkMcfo.exeC:\Windows\System\OxkMcfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPFcveO.exeC:\Windows\System\TPFcveO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnqzUsA.exeC:\Windows\System\hnqzUsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hcwqDAa.exeC:\Windows\System\hcwqDAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhCwkuN.exeC:\Windows\System\qhCwkuN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MLwNtFH.exeC:\Windows\System\MLwNtFH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUkqdPs.exeC:\Windows\System\uUkqdPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SZPMDnp.exeC:\Windows\System\SZPMDnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KibwlcG.exeC:\Windows\System\KibwlcG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xiBwoUm.exeC:\Windows\System\xiBwoUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nXCdJGk.exeC:\Windows\System\nXCdJGk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUpZYaw.exeC:\Windows\System\hUpZYaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MesSaWa.exeC:\Windows\System\MesSaWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQNwFkx.exeC:\Windows\System\XQNwFkx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvVieVV.exeC:\Windows\System\VvVieVV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKAoprW.exeC:\Windows\System\fKAoprW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkezxiV.exeC:\Windows\System\vkezxiV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\racnLUN.exeC:\Windows\System\racnLUN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5573c53a0a9c87e871612b35a40fc8013
SHA17703c50929fb7abfc02c9ec392ebf95c11c0a7fe
SHA256386073c6b771a1527f39efa4f550e24eb4906c1057557a2623e82d8437d4a112
SHA51223df8cc39635c42169b3b0333a6b2dc75c607a7d4f9d2017ffcc7db4d46fdef56141bba41e2fd906d99c2e787f4622128d6e7a180cc0be1de98d974e22d616a1
-
Filesize
5.9MB
MD524bc591fa2237226ecd5c7abe093f891
SHA1c3f18a4cf4c84c002bf0d5cd26cd715bdc466f0f
SHA256e38de7e90252e015c41c6364fc569449c283ac8d74881915addb99fd5b9ddaf6
SHA512619649a1e8ff91d3aaee4423f94d4c0bc7857c927b44d506a772ebc93c1fbaf4b9b09a03bbdd38c9bb031cc5d23de6ff72ced8be425d126c2ff8f47a6b0d3d23
-
Filesize
5.9MB
MD5589d440e0435454da7fd3a35dcf25b38
SHA16bbd4ebe233d2cda60a90bffbbcb19499ec616e8
SHA25658678ff6304f52d4e5da5a090dc1bc63e65e03403edcc420b3b2dceb1044dfb4
SHA5124b2116d6527689b51cd7bab4edbcf11c09355252447853f5660d2504b6852bf71d5ac4a6c0d7e71661addc0f2ca6300cce19166bb151b0b49a63643ce012fb94
-
Filesize
5.9MB
MD5e62ef6b83d46c683f0747924cef7aea1
SHA18e2c67c1878a4003120c1dbebc4edda853d2fb5d
SHA256545bfac3c4d06ade3d83d255c246cfdba32e161680ad539a11f33622940f535e
SHA512a1fe0a30384e215b8cf1728fdf591edda6bbb5a892b866077a4a071db19d8cabb1b8b66f54a00bcb7f26c0c997a90b9b549b8854e4f4fb38bd24d0069888599a
-
Filesize
5.9MB
MD5a12f3ed55ee3c84bf65d14da4a432bd3
SHA1f24f44e4359dc72a1c2d89f60392dfca1378ac77
SHA2569a7c316e13a943b0d633c37d10ddb556f94a5ecfe93d8707450b445f95aee47e
SHA512842debe28e671ce6f99b18205e50f26fec5e98801f5b7abf069134e51ac33f4eb2e0780da2344482517d1f22b3047b9db793f73f56cda62b9eb56fa429257d26
-
Filesize
5.9MB
MD57f757e8ecc60e3ed3dc79ff3ff6bfa05
SHA1abe6bbdab8ccc82d2fabab962528c305f46b5d0d
SHA256121b6d4b50eb214664801b702f5077718dcd4754efbd1a3ae59235848fcd9f81
SHA512851035603e3c17ad2ea129d9830a02e8e475ed9464f95503a0450a6a00ec52ab794a7b4f9c2a9a48e7849692567e6fe63c32245aaf127536abb1533989e3f186
-
Filesize
5.9MB
MD5ec1a64ceb92c2230df499042d36e32d8
SHA1559a73ad8bd20a9de0dd5ae3771bc189236beb57
SHA25625b9e96295e29bb35de770b7d4bdea6017e7c285f807a7e8520d98824fd65c41
SHA5121d7e3968d79391d1080a367e97b236599d87a27ec76e41554167f4401ad6666978634f9be789b6353aae7493a9baa1b30a1b191d2fd9e051d9e601223c278c80
-
Filesize
5.9MB
MD5123e5bc35c019a573cf92615c5b2c20b
SHA13730a185a5af0d01bdc31550ce8d72c7d9a5eb0b
SHA25697557a479a91891957463cab79050f17be620f155dda035eb18911f35c228db1
SHA512242ecb1968ac4aae822b1675e5d7166435fe4fa9cc2ea78dd447773fe1e56f128ae93b7dc4b85a8268cef8fb81353cef856348e1b1b97fa0124cb7064be93ee0
-
Filesize
5.9MB
MD53010cfcfa83ad8853ea954d84b1d30f5
SHA16aa6de6aa491921f880badef83bb6502b8de2336
SHA256c1f1210fe563494df2ba75e9b6b6cfc4016ba1c520b280d0e8377e0f690c52ee
SHA512171d41848a39c8c32c635f2273843472d4bcd360fdc7c6b2a16f86179bd6ffe6820427057e1495fbf93bcc4e2989ef87f7f4393556422300506c9ab64b51b222
-
Filesize
5.9MB
MD513ae1b096db54ecf1185a92b11cb860a
SHA1ad8e8864a2fda143e0eecf9a1bed4a5085be749d
SHA256dcff28b4abf41ac4dd5120d86a97879f2ba314adb013fcd98cab13a4527c9290
SHA5124c0a68c527192772e209475bc956062e355d6493f321b8b81bc46dd4ca38dbf6fba763100e08b859d2b356e9defd6940989afc63a682d7db8136ed2321f830cf
-
Filesize
5.9MB
MD5c4b7755e8379153056ea792d831a009d
SHA12196b365f2d4de9f39b4d4d077bf5c8345804e18
SHA256111d178e82942df785598fa97e8c14cc57445b43598a7034eaaa2923b5266a3c
SHA512eaf72759075b049ce5b818e324b6578668239486b25af9d1d172eae7c2a6cabe4635191fa65360aaec87f7cec8c58738357c1eccfd4916ee321c8fcd370e48a1
-
Filesize
5.9MB
MD59dd9b702433d569023418c24ef02186c
SHA1720f1eba3b56f600d7e09155b0560b964223a2c9
SHA2565426c3e1b00bd698b6fc27e1d73bf47821d214b960e46aa30d4b0cba2751e751
SHA512b05b6678614a6e46db850ed8c864ba053beb363c55d0b13dcc2fda888dd8e9cce9a27b3c0c9123c35cccf31b83421cfa0fb2e474fe1d0c65708045946cc8b60d
-
Filesize
5.9MB
MD5cee03aaa8840e1f48739740a1ff15cb6
SHA1e59ad35d4595e775ccef185ed71e58ea2b7dbd17
SHA25662f1e3998eb2fa60e95ed4e73aadac59e1022e71d9dd3f3ec1c4e9002fb421f1
SHA512822c6286c32002d6367db319771e3e5f90ec9e4c250d2dd3d84a4446806c3a87f8f504134a02ee21c78172a56fb5a283ae5e9d8d29f0dd13fc2858ba5766b516
-
Filesize
5.9MB
MD5a8d165d6a399075c7e7c5bd54780a83f
SHA1b9fb2ced2bf044a15b76fb98605e44bf7bc22d37
SHA256bc3f5b55849dc58f3236e758b0b95ac6c94c45dc9374d63a31969433b01e1289
SHA51235c844698aec5ecca126ecf27f093397fd0542921a2b02ebbe411c0c6eef1568499a370bc71ee092a33027718e9ae9b2762592ab739b59403ec090a627d92e1e
-
Filesize
5.9MB
MD5a93eb62f68421103f89e94dad0f6fa81
SHA171522fb4be4682e667d28226f8e446416676bc08
SHA256d0b9ed92e558065bcb14e5522b25f9a7336a7d939dea8f42ee8c02bcb3917a2b
SHA512667ce4a850e599aa83151ff5b5642d55bc6a4a5626898fe2a6f371c6154b5cf2537115ad3d2195270c98ebb403012477fca0ee0bd5484feb2983d266086e87e3
-
Filesize
5.9MB
MD5096ca9377175361d5efa1e0b2dfd490d
SHA1c8f77b0fea602fbdb19f00807edf5dde2eb41ff8
SHA256664f506579439e89f24883fb9fccba39c8e87385f787d811c725fd34b164e564
SHA512bc626292053056b9da284c6502bfc93222a2dbd779b0ee74d813e9d34fd25b3433d5799fd339b19a1e02487aafe55fb0f7b09b1f656a1eb1544f4872d89e6f1e
-
Filesize
5.9MB
MD5008d2530c0dcca9d10bb1f5b5cc2364e
SHA1d04d9387c45f1b31448378b11146e740aa44602d
SHA2569e9db80a08c8dd59d45a19ea3ab5bc985436e07d5cbd1303c85bb68bdb24ed08
SHA5120b07a21fc8f341cf6b5385c53921a1e92b90c705efa403ca7a83a6ef288e5ec6eed3857668bd98939d04a73257a4c4ab65c7c7872a683dc9ef79769f49ac012a
-
Filesize
5.9MB
MD5a0ed59ce14519ea9016a417da42fad3d
SHA194cf9f518c3f4946de2f2a6c98cd05de6719b760
SHA2569afe0f3bdb0bb33e4f88bba0a5c27d6e441547d204d140fad20d40109e730ff3
SHA51224392679457e02abaed22a0119650aa1e7314f86552c97b7a2833b1a267ee322db2854f6fe4aef817c75e1777608e4cd7270685396ca7cace3482f3ce1f270cb
-
Filesize
5.9MB
MD5bc9639a476e6224cce8a4e051804187b
SHA1723c3a0dcd563facb89e91d4587ebb70b90adfca
SHA256b229bf405868e94d8079226ae48d3d33930715a91f1186848bffe6853519087c
SHA51215c8664dd7a7a832710edd3720da4fbe72f7e1cfb8fdb3bd9fcb959c576d9c6eaec9a1efc32153706c441ec3146807ecf2304821cde9cdde3c6921df3a59873f
-
Filesize
5.9MB
MD57da22d564abfedf7579f340c7f2df83f
SHA1b012bb71086a7910d231909560760e5a1699b047
SHA2564d24de739cd96f85015586e88fa4196412fd387c20a35d1f49b06156258be222
SHA5127288f6fa2ebe0ac675a11849c60b83aa775d4e835374d9a1b160e435bc9160c7a8c3df984210d8176fced48027e006016ea974a74b5508ec3d7f10a97836fe94
-
Filesize
5.9MB
MD5eb106f9e5b356363a1407f685f63517f
SHA154a6efa12e05430bd9e68351595f6aaf0d17c549
SHA256337355d70eb247fcdda271d66c19b0545a8951248b065947f442e47239c11f04
SHA512c87a8dfd969e620df754c4b06693d54efcb8cbb6390467d8b337fa41bea3b274fcac8cb0348b4cf19950e7a91fb6e904c0f47c4f8a16f69bc3e01942829bc800
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB