Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31-05-2024 16:16
General
-
Target
2024-05-31_f4ec19f830dffa2caae36960f513434d_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
f4ec19f830dffa2caae36960f513434d
-
SHA1
e1e42c722735333949fde4cd1901dfb8d4f81d82
-
SHA256
98fdb3952f5fd096a4b3f7605d5dbd58ef52ed8efc2984ba87db8f263f9647f6
-
SHA512
aa484a3a3d0afc8cf60caf82648c992198db5e62d63faf8e5eb1372508ed5195448495dd546d731fae6f5a863f24870d4c2475db52ae95893a01ba54247b56fe
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_f4ec19f830dffa2caae36960f513434d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_f4ec19f830dffa2caae36960f513434d_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KPqEkcz.exeC:\Windows\System\KPqEkcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwVOymr.exeC:\Windows\System\RwVOymr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgamQlY.exeC:\Windows\System\QgamQlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQIYDIt.exeC:\Windows\System\TQIYDIt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzDlDEZ.exeC:\Windows\System\tzDlDEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LzrONRW.exeC:\Windows\System\LzrONRW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gKvGmKo.exeC:\Windows\System\gKvGmKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uipwkWW.exeC:\Windows\System\uipwkWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjDogmF.exeC:\Windows\System\KjDogmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPETFBn.exeC:\Windows\System\kPETFBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tDjrGhb.exeC:\Windows\System\tDjrGhb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xxSgpEB.exeC:\Windows\System\xxSgpEB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CaOehpP.exeC:\Windows\System\CaOehpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vTgzjDd.exeC:\Windows\System\vTgzjDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljaewEE.exeC:\Windows\System\ljaewEE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZaplfLd.exeC:\Windows\System\ZaplfLd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Qfgkbqg.exeC:\Windows\System\Qfgkbqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QcOYBZh.exeC:\Windows\System\QcOYBZh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XaOcPBl.exeC:\Windows\System\XaOcPBl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPnEGZm.exeC:\Windows\System\EPnEGZm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWOHIAg.exeC:\Windows\System\GWOHIAg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD562866115ab67953129d2a435b23c5d5c
SHA1d8a265a14a40634447eed2689b5295c03134787b
SHA256f06aded6564cb1df026c4be40c3fb6beed1b2399691bc6277e62d34d4aa42b95
SHA5121fdb664172bd389ecf5f26f3ce78261df532fee4cd074e527b6f173c2eb3c7a8d4fb46ccdc3c010cfbee13c417bcb2a0d860c82edd89f79e8a67a09e9b3ab655
-
Filesize
5.9MB
MD5ca2e173ba43c7aa1ab2f1f1617329338
SHA11bd80d600386775f865c3f76aa30be901b7fa4eb
SHA256d72510103fc048e12de4ada1a936156fdba90344299dfc5736ddedcc47fce19f
SHA512c3ac8f79ead77b1dc52909c7d8439aaeac6c157784c7e769d8121cd38485de15d9a2292751fb26c786a884669b32ce23ee39c3210f0266a8a8ae496acbc70dd3
-
Filesize
5.9MB
MD59728e6a80f5961edfae545741dbf1f57
SHA12c2075d4abdf611795afa35178206d4de81038c9
SHA256f0e8840c42553963f7f99199fb37b0edf0232820b8b5994353644201ba413cfe
SHA512806e09a85cc80b405471d42ef29cdd0ad340aa42f12e45cf7a4f4d48d47b8fa1be0d2ebb5b6f6ef56522113ee07cc8f4bdf8c10103284a5b433cf4046b6e686d
-
Filesize
5.9MB
MD59fafccdbf958d14f9bb4a041990b6947
SHA1d21ca18551678f1d0a9524e5767c60a1e92c41ed
SHA2562204abb1e4a156e14b3c28215443181f1562e98aef52b60dd3d6e9cdb23c8ee0
SHA5125e7130bed8f2fe685574b25c028b495d2e483230479190636c375d1773524d6bd7f63877b8ab1363cf406f7f6228d934716b4efe57cd8117650bc3c87af8bb71
-
Filesize
5.9MB
MD5b9b1c9ef505424f94c2556166a655784
SHA12db753f04f1e36f967a46f7ddcdb60665999448c
SHA256126c951ef1ac46c41eb80739dffaafba8dd4cd064164834834578ced046bbdbd
SHA51265490ff11bf13c8d93a3ba96fa0ba9681726cef7ceb0068afd2694be5502e6ee26ebb329509cab3616b3e8b08a01bdc2fab46d7df872fa9853d01779f985a9ff
-
Filesize
5.9MB
MD5cc692a20879cdb0c7039a6031c7f8eb0
SHA16968d58ba1bf985398b999a7b14637e08274a497
SHA256e4bffc98a8e1daa0b20714bf64d580accd391ebc4c12332acb0e120316c1faa2
SHA5125989f8d13f187ece77c91fd47e7e385f743e506991adbeb8c3e87e770ddebdcab6e2203acdc7c4ae713689fb906465313d64f9e694fa9516e2867b209a413af7
-
Filesize
5.9MB
MD588b7487e24336421090b96a9e5a5b0c3
SHA1498a73c34780f15f06bcacbb4420a859130983ad
SHA2563ba41c3cbf7fb9c8da70d34fed47c5247fa580d9f818c40bdefe746dfa64622a
SHA5121ff8d80f35c05c3a80c22b68ae60b6e7f97677cb41981655828ad46e7b5800f9941235879287ecf67dd1c1c6c609da9863caf0d2efa09dd89816c886baef77f4
-
Filesize
5.9MB
MD5e61cedb1c1fe445ca5a579786b030bf5
SHA1629e2998bc0575ee6570fd130c39fbdfcc35f5de
SHA2563ef096b92fb04c672269beb7e22f452b9f40c84604ff697d51a6691a946319ce
SHA5122fe9a0ea128f846241717b56549f9ed9947c926a93fee13ed058afbd62d1c34ff9ef76ecb424640c2b5fc9a4ea144fa84e1d2ceea7ff76cb10e4bc6a86de7b1e
-
Filesize
5.9MB
MD5b4fedce44ba708d338f32ae47d890574
SHA107a3e8a48665a0c3f5521e3caec345835b148a81
SHA25655599d7c920f19e9415bf32f3189f616ad3956355222f3f20192ef60b8c1575f
SHA5120826da4c06dae6e8c8d21d0f80bad778c5af22bcf558bd3aa9b899e6f02241cf90ce35c78d66cc832ff57cbfa7b2d2616b1d41e566b6ea30ffc24dc00e4657c5
-
Filesize
5.9MB
MD5295d3d5bfed0a54aa9942edf56ab2166
SHA183f91d7d00068a4367029028b96a10aff27ada87
SHA256dfb09ec8d285b69d357f0361157b05ed2f0f3468ce43ba995f2498e1c169430f
SHA512c918f87101316db251d481663050b0fca964c646ba6cde2182a3f7332a869d08f630f93548a387735b56a08c9247e22822f4694d6cb0a429eef7f94959b250e8
-
Filesize
5.9MB
MD5977621c62d8c07bc765dda08d3f00364
SHA1f39ffb073ddd7977421d905c1fb478dd09ab5e74
SHA2568784893a5891a06c7eb923b4eab82ae8d55533051b23083eeec32bbed42407fa
SHA51275995fa35d56c00f4b26d3c0ad2be851d82d71e0d438481df45830adc1f3c0c6fe649dbe9f0c2242b31f3987dc9d6d5c34d6a429fd05ca38ae644eedcda334e4
-
Filesize
5.9MB
MD5afa459e687db3b8030dfec4e21547a8c
SHA130d21af10836bdecf88c69e076a1ee338268b32c
SHA2566577813cac043b243936dab9351fc9e963ccb3e6782652ea2f6b01605e1b3c37
SHA512a8823db220f817f94e72810b00489ef7070e6f9e7b3875339cc8eece4d56f8ee3f09a0c5985242ee2d40b0840743526c057304c38ed4756139d9b5191e271365
-
Filesize
5.9MB
MD5962756ec8012e57a5af9b52f71a32b0a
SHA1f90e5ad959a10ac5aee2e029ecc8c0bc9716b46f
SHA256892b99a2e2cf143ab01a4d6574b8de0dc7850cef66b47f85ee9e0f0e469001b9
SHA512b2a0882f388e5aa973a03dda167878018bb29ecc25864d6bf2c3802294d93216b4dd12eb735bc6b38c6a705f360cb66c9c058992438f7c98145abc2bdcbc74cf
-
Filesize
5.9MB
MD50b5d93484c5bd6920e737213c6bfbd1a
SHA1990a6838781cc63fc9fe5aceea69cfce7a8515e9
SHA256bce154aba5ee75f8b153ded1a54960c9f816e3d6ad4b4bd088230d65a4e29e2f
SHA512dfc6b451ebb5a77053120db8b72e831e8b36e5ef197c0b28d9790070c4e01d6dfccc694da8404863642dc3548125559821f6233a8f528c1ab54ac0056ed845b7
-
Filesize
5.9MB
MD5d8539d98f1210eac07fb1dae214d43b7
SHA1c5d95590ba22f59ad8d3f4419623f91eeaf5c909
SHA256d192c188cc14def6a6caeb9a6b4a4c1f2caede6e10b6016e83734e6ab5fe2835
SHA5122085b303e3829227c35ab402b524271e95884309423ab4f49e06408ab67ffcc815405cd9cf6ad405ab40701867d070b9a0abaad3fcd4856a39a9afe1d526451c
-
Filesize
5.9MB
MD50bfa87daa8bc4f4eb5acf60659717353
SHA16c289b9ba1ee2f2add5d356f00b76f13eba15c3b
SHA256b00b7d457b60bc19d0005a3fc955310b0f77aa724c2d3c5650c22c44b9ecbdc3
SHA512accc0df8ef0c1652293236970197a39284ad7eca37b620fd2d0cd77bdaea169f7e4f25017d379a822231e3a8bb830582b9d650b6a35b04026a2bc6ac83ff47ff
-
Filesize
5.9MB
MD5c543c52a69a4d722e6da6361ae8448c1
SHA15b31e5b1683d1377493eae69622a0dc2f32f6325
SHA256db5f232420a5dcf5cbd80e772970a1f0ce9353b5ac8c4eee1ab0d7c04fa390df
SHA51207e172cdd8e13c6dc2833bef1882fc51820337c4ef83e1ee90a2cdd2b1a2742c31bd2d67316f836e7b56f1129a85951b999ba7c7902c5b48f705621787cef8c3
-
Filesize
5.9MB
MD518fac120638738e45d3e301ea35773f2
SHA1b8f4562e265482a89c5f4cf47f888b4971618c76
SHA25602bbf4cb04a9fd090a1901e768311ea7b338d12e2d4524324d9faa07a9ab7782
SHA512be31bad5eaac74218d9015899b3f3a8c613659e7696653a6fbafbdcf57df14738310649ba8c405a9c65cb798b1433892b24314185d0ecf6d9afed6de329b52f6
-
Filesize
5.9MB
MD514f1ad7bafd09993e87b854b0f8dcbdd
SHA14dbb1fd94740d39b0778be64b00ea897aa934f36
SHA2562aa5fdc1edfcd3706fb166b94963e6bc7b279ae556437bb04fc233d6f14b28f6
SHA51244ec3a006d8ed2ff4d49c2e691f718ab56368b15b228bc20580d93fd54539f3d55b046b3d296cea81bb660b6bfe378757535d4af43aa37ed6083dbfb849dd93d
-
Filesize
5.9MB
MD5cdc73bd8ac190adfa1254be8faf5502e
SHA134b01ada9b3e2efe8ed0b83122d3c058416f23d8
SHA2566d416deaf8de7344406754d913f9847ba62779b07a85b1ebf6395a7654a6dc86
SHA512b576e46c1b2b19808a280d2332b07ebdf46f0f7236678756c8b5d8b56046d544d968b8b00b45a8fb398b29ad50d5315657947d9e604e5ed925c305fe368717bd
-
Filesize
5.9MB
MD50ea8e6c17da9fcb9bcb34e7c092d6a80
SHA1b45b41d95c82bfa937dd7618ee380298f6fee05c
SHA256c8bbc410644766fd5ad2c744ef3dd6e8baf04c31dd515461e40b8b4a0d15cea5
SHA51295ef140d93c267f54feebdc770cdb04c28b791c3dd229a73508c14e813dc85f5ed14dc9ce91dcc2194eeeeaea0fb1515df9ee883efad10cb37b520345132434c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB