Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31-05-2024 16:16
General
-
Target
2024-05-31_f4ec19f830dffa2caae36960f513434d_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
f4ec19f830dffa2caae36960f513434d
-
SHA1
e1e42c722735333949fde4cd1901dfb8d4f81d82
-
SHA256
98fdb3952f5fd096a4b3f7605d5dbd58ef52ed8efc2984ba87db8f263f9647f6
-
SHA512
aa484a3a3d0afc8cf60caf82648c992198db5e62d63faf8e5eb1372508ed5195448495dd546d731fae6f5a863f24870d4c2475db52ae95893a01ba54247b56fe
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 53 IoCs
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_f4ec19f830dffa2caae36960f513434d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_f4ec19f830dffa2caae36960f513434d_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HeOYSCH.exeC:\Windows\System\HeOYSCH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFbOvDC.exeC:\Windows\System\FFbOvDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\horHyaN.exeC:\Windows\System\horHyaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQeOigA.exeC:\Windows\System\tQeOigA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQGqheX.exeC:\Windows\System\dQGqheX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqMbrjJ.exeC:\Windows\System\AqMbrjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhGWudf.exeC:\Windows\System\WhGWudf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbwAnUt.exeC:\Windows\System\bbwAnUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGEYzML.exeC:\Windows\System\IGEYzML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YomLwxL.exeC:\Windows\System\YomLwxL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjDaLuh.exeC:\Windows\System\XjDaLuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xXWqBeT.exeC:\Windows\System\xXWqBeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wSySNkW.exeC:\Windows\System\wSySNkW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TOaUdYH.exeC:\Windows\System\TOaUdYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKqhtqc.exeC:\Windows\System\uKqhtqc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QuBgQci.exeC:\Windows\System\QuBgQci.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AfatFUB.exeC:\Windows\System\AfatFUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfkYtIc.exeC:\Windows\System\TfkYtIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtWPYiL.exeC:\Windows\System\mtWPYiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pfGbSch.exeC:\Windows\System\pfGbSch.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ucGkIpP.exeC:\Windows\System\ucGkIpP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51d88d7597e8d78abc45ddf38dc34cd16
SHA171573bef0b6ec336cf62831e9082bc72c61b7e26
SHA25639055743945f36119475037a425cf128831a92f27bf3f71e10384fcb9735a5e3
SHA5129bd77f03708cfcbd3dffb7e3461d30840abea0d3c104ccbe83b69333089a9b8637734e398d47a39684243fc9f256af1f08420d4e3cfaa394ca6f113b2bef8018
-
Filesize
5.9MB
MD5ffc7c4e58fffad2c43bd5b768e8923b9
SHA1feb27881790d63c012dcf8801bd44deaf1f0e424
SHA256aadc70af4ebfd2bae91e7345e6592fcd4c3462c4f2632359eaae595c7e6fe5de
SHA51214e13140fc4f04442e4e271893e21a2f9be5322cf0057c92651276b9d9007df89d90a03952a7a528285b832c6038475836499101f69550ff61bb97d33c8bd3be
-
Filesize
5.9MB
MD5d98a3daeb48496b919d51e29af085e96
SHA1096224bb6c6f7599032e9cbbcd4098086eb18dae
SHA2567f412a7a036fffc995d720aef1f34fd6df55ccc8f281f72aaafead9a8627ee11
SHA512afff6607fdfd6b27c8c75b52a498f0528bef061ba67ee24ca394140e0d6bef435b68d0bb1508a3f216b907fb5983933bab520ae62fcc57de3974476dd6045185
-
Filesize
5.9MB
MD5b8aec6ce8bef6f1bf46d5f401dd96502
SHA171972fd623e7b26c90cc87fdeca5ddd0eefaea0d
SHA256b085ba17bf23651615f873ac287b3f290931a7b6d3a0f81ad5c5ad7eba9b3f20
SHA512c7e1c9d1f3d205b4ec3bdc4859fea1e4dba9158f89f927ae1e152586fc09daa15dd21f5eddec1e04b748b1fbd84991c7ed811cdd1c7803484a6e7aed9281a157
-
Filesize
5.9MB
MD5d593f0729acd3a15b43bc5bc2f5af1bf
SHA1a48313fa54a1979e39b4014968b8fdc90d53bda6
SHA256b266fd9429cad1a4fcf637886b9e26cf1b7be37e704b9a82aa59a11f9493f9f5
SHA51285e59773fea5ad0f063a49a667f32ceb81b38c5763e7f9f630edf37da8dd5f4077940c86bd0a24162e0c17e3bd1383c7709317356a9ceb7aaf5a0cf9fb7fa7cc
-
Filesize
5.9MB
MD534b07fa20281d52d6fc0d05c80351658
SHA1a3de03b91f53cca75e899c15db0adce09ad5c595
SHA256b09ecc04fcac204e538d5e97c0279f967954d8c1878b01e9d97744073a1e9d7a
SHA51216cbfcc96878ad57e91f029ef77dfbdb64f6e51c412cec1ea365806212def4f8c24ec3dbf4ced614110dcdd1410a1f5c26e1f2752df0e5778486cc554e39a12b
-
Filesize
5.9MB
MD511d439845e109cf641a19126dc5094ea
SHA13db53c6a0c53bdd4e8efef433224cef2bd5ee2bb
SHA2569f43bfb0096fd231d804a4d847f2a40266aa92608ffaa9be20783eff4f86a7cc
SHA512bee5d85d90d4dad2935d94196e836a3fd5cf5c62d4051b57ca481ab63c677363956ba9195dbea0b15df99a426d281541b5bb6cc25ddfcc9e48dab0435b0d1b5c
-
Filesize
5.9MB
MD58498ee1b6ee12f10232632536fa753db
SHA1d90926f194a58512ee4c976667ee0a8f0d65a44d
SHA2560ae6ce4b01c0764c9a7823cdfb98a01e08c07590246a88718799b33fb156aa71
SHA512e7f40b6ef2c76dcb7e4c5ca1508aecf4fc65bba42d0ab56fabd6db2dce0b7cff10918d8ed51117c067a1c49e50d772d0079bbbb73a7ccd7199affa8983637b19
-
Filesize
5.9MB
MD58c5f40fd418147d5e4801abade9c29e5
SHA15f4ba6baacd92651eb699d43963b44bd3b9333f8
SHA25674d3c9b73ec5462a586197e0960b129bcec3898892cfa182c96e2925395a0c42
SHA5121bdb6cf29926fa768719a09e0df3513e2f3701f86a853e2d065cc79ba9097ff767551f20b1c65df435d47115fdd180d4ec455a924b6665501e7f75cf9717264e
-
Filesize
5.9MB
MD5b9538fe2d62e0b89d86042f02043c7d2
SHA178ce24ab2c07f0aa4ef998ad5a3b60869ff2e830
SHA256fb2c2246133141aabc32eb3e9875835937d04de07731b16d19c404a2d575b734
SHA51252a927abee4add13fd5d98da83417ee75fa0e8a1f038bd7ab1a2efee285202c9de739540d16c5789a931f8c8dbfc854c978fd23edf9cd9a1822c8c6d2b524a29
-
Filesize
5.9MB
MD5580d42662d83cb47bbf0422d520cb549
SHA150b2de892977b746d4891d72bd662098086a48b8
SHA2568224688473460a38319cb6a6a435235554a7f3ccd2cbee50c26ff1a53efe59b1
SHA512a739e6b75fd641fb2d6e3517ccfa81dff702bfa8da7224df0cd4d190ba8a7ed575d836ad3a0db20bda3493440428466a0cfdef40040d03b92fbd1811c3c610be
-
Filesize
5.9MB
MD5e7153ec58572077a5d316617303d660d
SHA18c31e714514c1161ba151a3a477514cd9b58de54
SHA25657c313cb108e709f3a581e4cd98c74df5cb7fe23911c61a660194ab9b837af23
SHA512e0f9d135cd373c9849b99f3c89307d289b5b1875402669ec76a1bd96c7994aec807bb0092b209760da56e455943f6511efd4d1a5370605f3bc8187034b520f4c
-
Filesize
5.9MB
MD53fb68cbf3991ae0a78be099369f08e14
SHA12c15e0fc189e6a25e03e81f3489936bbcebdefaa
SHA256842e0fff909acafeb196091a0a14b58ab8c6e8cea60cfff69cf5b522dacbf0fa
SHA5121b4bbc93fea2bcf7d10a60980ad58975e71b03fad3abb6b6627b54e8ef866f7948af8801af2bcc07ec5bdeebb0c1ec5721407ef7c19d545eab2a0c5ea117ad49
-
Filesize
5.9MB
MD5ff02e04077d001dc0ef402ecf7ee63d6
SHA1e69f201cd9e04d5cb5dd9462e78172195d1dc624
SHA2566837e8f670f9f164b981a86a5cb504c3979bf258c86964b2c6640aa039903a3e
SHA5123210b5b2ffae257992c0609ee907edce81ec7f65b611f6c700e653e63be36b79621bd913f503c9e16f6287c177658968d6ec14dff99e73653312390d9dfaee0c
-
Filesize
5.9MB
MD55d018db67b2f8d28142ae467ef881118
SHA1bb07ddeaa43e4243f216d853e6b1e28c63234c0e
SHA25614dd9d3628637d89f6e22203141a7ee00b8cf7b9255e226b55bc437decd79eea
SHA512b800c36e6796db01f8e1e5544d1d28406927c2fae1d526f82015bb27c5dd0fe72a7a2a065b24f5f5e624548c041b07e1a78d662499c2852ad98b312a35d463d8
-
Filesize
5.9MB
MD5b5e4924b47d1c1410b27cfd0b9e8ffbe
SHA12afaa50575197b1f606b034f3ffbc29d13e2d850
SHA256c711c72c7e025f27c8b37f53ff759b7bfabbc575a51ef74e118496216199365f
SHA512bc1b3b02ed634207d6a206b9ebbeb4527407a6f2b384d537526d3f881d87b6266a32da011a72470b5f1cec2bd0fbc0e163f5e3d812b5aea11299a11f4b3e7418
-
Filesize
5.9MB
MD5c91578a985ec0170c08d38bc6c7a6cfe
SHA11daab61f84c28f0b464539d5400a5617e560a0bb
SHA25674b5190867d9bbffd0ba078369fc2d5112f6a48ba2c19efa0c4871e2f3a840f6
SHA5126b64b02bc297818c6fa363a81336918a536f5bdce91af36a1b5acad1b66916caf77034c4b552566e8d21d44537c9d318172d999409b285d14a0ecee62d146529
-
Filesize
5.9MB
MD56253d11673d8d0f610a1335b9ffb2acf
SHA169262ef084dc534bd9b0e409f9a151dffa11e81a
SHA2567f8c9f46d24d13c6ebfff745a776bb5ce73ba53f705bbb9cee18cd970f43760b
SHA512fed4b9d5fcfa011e94b573af2360c854457de2ca2e4ee504cec449fd08349c78b9d98a489817fc6cd20223f048e23de4e269e867f049b8db2fd8b914f51f15ca
-
Filesize
5.9MB
MD5980774154c0b52f8f01e22c464e10bbe
SHA16dd196793ab0a1a637666e583393e299051017d6
SHA256d9ee4c9321f50356ad8616ce95c4fb6953026a0259706b9213a6252e8deeba77
SHA512448fd1adecc55a1f388166a3d6201b79f164e35d833a23ac3a1e8d435c581e4611b792aa98a6e07228ddfe2f464e62c91f96213dda3b6b51a390cf7f697aa3d1
-
Filesize
5.9MB
MD5cce0c23871c751501fdc772034ec767d
SHA1350dc960c8570d5af0300e4c2ca5c453eb88532c
SHA25601bec9a5f4ad001574befd50cf99b534c66d0f913975bde2fc0d4a40d836edb8
SHA512a90e50c31dbdb8808663163a180afd372a1ccb49fc7147de42ef6574d311656c7157c4ca4cbd8260fc0602e44931e4c7aef7f9df5d97a8297f36988265abd7a9
-
Filesize
5.9MB
MD54a2387bd5a8e89b56f0d44ab233e7e04
SHA18f3fb3c275d2338aec797fd8efe472b483ac56ab
SHA256e09202d9c96986ebe932d6d244e4cdc65effd0f8f5c1a1ccd9ba146380fdbd34
SHA512d12f27fea001e54706df3b6055ea56740117563c0241a849c32cd1500d6c263405f49704bd16d92a8a16bc87b2c1a64a250207399b71e835889fbbc00446ae60
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB