Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
31/05/2024, 19:24
General
-
Target
2024-05-31_043bca408cdb98403fa975a671ab594c_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
043bca408cdb98403fa975a671ab594c
-
SHA1
cc36a0ef74d32dd5930a307cbe15c76b5f2ef99e
-
SHA256
3e37e0761b25fffd306d2f1da6c5140f83b8364515c4cdb35ea5a3b3e0efffee
-
SHA512
698ec5e3ecadc943e5d71a109cd99918b20c9f246dfe4c939282b90cbcecbd5ba97b3f48f093d01ce05656fd3987dadf5e2aa54257e69444c668d9ba8a811690
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_043bca408cdb98403fa975a671ab594c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_043bca408cdb98403fa975a671ab594c_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\weWxArS.exeC:\Windows\System\weWxArS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxslqBI.exeC:\Windows\System\XxslqBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgEaNKJ.exeC:\Windows\System\MgEaNKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqFLXeH.exeC:\Windows\System\NqFLXeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlIBadd.exeC:\Windows\System\JlIBadd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dSLdkFD.exeC:\Windows\System\dSLdkFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAaDuSF.exeC:\Windows\System\RAaDuSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJkjFTD.exeC:\Windows\System\sJkjFTD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwfvmWN.exeC:\Windows\System\RwfvmWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uXxdTFX.exeC:\Windows\System\uXxdTFX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\joASnLe.exeC:\Windows\System\joASnLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKRjYkm.exeC:\Windows\System\tKRjYkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxrIFqO.exeC:\Windows\System\RxrIFqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGIrOil.exeC:\Windows\System\HGIrOil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LTOHROv.exeC:\Windows\System\LTOHROv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SRbGKsp.exeC:\Windows\System\SRbGKsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBHXodw.exeC:\Windows\System\tBHXodw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwdIzax.exeC:\Windows\System\BwdIzax.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eywktWj.exeC:\Windows\System\eywktWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xBBvHQa.exeC:\Windows\System\xBBvHQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntEkBXl.exeC:\Windows\System\ntEkBXl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55ba833cc4c30e62135a095dd93b9ba90
SHA13c523cc085af30945b5ef1851a246410655e8fda
SHA256c9a21289219000ae42988bbcceb13daff695875bcf4a9f4546883065eab7a2b2
SHA512a9557dc1d10065c6bd388faa05171af404b80e7a7ef44fce98d79145eae1f9c1b042c6aa1bd9949cce5911b3bd09c3c973d1253e0e12d3f244fff5b4001eea71
-
Filesize
5.9MB
MD5154cc1f8f559c63fd4bf44a6b7306598
SHA1fdd0fac2b94e9cb5e6638a56c6f11a81fe2d8915
SHA2563b4d9785b4cfca27170eea9bb4e4a898a5dccd45a20b7eb86d33afd0777009d5
SHA512293af275ecaad80cab8cab5f7d7326387a228db695fdb08bde5ddc6248691cd620d46581b3f9e10ef10b937cfc1c22b7d4d20bfeade1d2eeded49458e5ad2d4d
-
Filesize
5.9MB
MD5ba5d3a4706a25097574c4880f4267926
SHA19533e8ced7abee3b512bf679ec0f4fc2a9108d13
SHA256ce6b52d34d2c6883e8e249c889d4361fc98d25d0d25363de14403d9faa50e5b1
SHA5129cf12a1919f01f168b6468a3fb47c8f47b1232f20ccc2e8266e6e98245c4a1d83a415eb1407075209ab003847b425c793265c5563367b9dfa18136f390f3161c
-
Filesize
5.9MB
MD57e2ec4c023037bcd3886b30770d2484d
SHA181af9c24f67be1bdd485a953273539f4cdd8cc0a
SHA256fb0c56bfacfa7ef3165a2819979a22e77aa169a7e3fa54c7afe5879bf9058ffd
SHA512464d827437f881c11679b39ec34c3d91523eac529996f122c7456a4831b59dc7b0a33b5bdad30bdc8b966c65f6819c1affe4ad993f029827e0982f08e527d1dc
-
Filesize
5.9MB
MD59a3c6551b0e0880d1000548dc0be3688
SHA1fe669012b5c6f13c8852681e3317e5dba8d61202
SHA2569f031e50ee1d98c1f6e77c0e60cabe49a092e484670b919b9162986f66ff0986
SHA512c4825df47e182c85b04bb30cacfacdc6cdcdda5706fe4165ded78b386125b86f1cae81525fd34654730ac569ca7d1267b2b4badfa4c82cacb67a69f9579b53c3
-
Filesize
5.9MB
MD5b10a12c1b1578541a0056a15057dd8d6
SHA13b42ea886cf71e860069d458590cb3a09ae57eda
SHA256efef225e820519fbdd69234fa3fc563059779c1b41c9ce8497374c81163e71b2
SHA51293a39a4f55591a99416568c020d45857a2bdab5dd33cde49fde75cb5a4b8ea4edd25351ee12f3dc06fa28e2f1a9f8eb27911a93c25084eb15b2959ef04c4df66
-
Filesize
5.9MB
MD521156afcda38d5e844d058e4db86b475
SHA19b880b17786386bf3d7aca72407e6c4212cc5684
SHA2563ce7ebfc5b43072e4b108af471dcd93b17688d0a8ea54f2d2cf63c714f703464
SHA5120b8c7cfa34a4e734e55f2d533e52ec86d7157117e9bf84f38f2ff9d4b7872aaf885204b00bd9e03e4b5fc7931f652a88230d389f0dcda0e70016b9d577ce9846
-
Filesize
5.9MB
MD545259d2075a2b3361cfd75b6869bd197
SHA14ee6eb0083f7d569a96385e22306007354b24c6f
SHA256b1e3cfcc6c276489852c26b9c4df00461c115a367f821a06dafbb00d69879bac
SHA5127ca44498c5888613ca966306fd0b722e46e04f80d15005ae2934d07288223384ee6236a8925980c93a02e6332d85dcaf706ecfb37a3889e8a0a5a5dd34bacd0e
-
Filesize
5.9MB
MD5380d8a884dad6ce7df305fc7e6e688ca
SHA1bf9e765841820fd13661e695b1b5e97863753ca9
SHA256e7ccff6f79c0daebba60c98ed189e03668446e2d6bbf75b3dd0ca985f8ecb3ee
SHA512c5b263c91c41115e53536224aabb606710446fd4862e9269edc6fce375d04c602744e743a4b4c7a0eb8635266a6d4abc7658088130cb86a9c293e1918cb62160
-
Filesize
5.9MB
MD5e441d7f1b8c75d19c50d528ace912e61
SHA171c2fc22803c2e3205875bbdbceb1d2458f698a2
SHA256d5aedef31cb8d87d341ac36ee66f7c8a10d9f8d290d935232e6d083511c52af4
SHA5122e610591d29e013caf9c6eb41288ae028b9aeb691a2e20ffc4484a7209d1b466c2fb8d43e938ff7b6f802c53c53ae4401022b2f66efbe1df790ac2e483076a28
-
Filesize
5.9MB
MD55c26148e51fb1034f03a70016fcaeeb8
SHA11a83781e8d523f268b980e03eeec772ccdf01c86
SHA256319fb456caa32ebd77dd60de185414a62868724be1790c66be65fe4d5578de6b
SHA51232702ddc0019023b55eba6ca3ec45bfaca552a5ae449cb7a1515cf12ac665a7dfb424fb32b6f0e62ac60180a0ab4625eea3d12d31281c37be9f23432857630fb
-
Filesize
5.9MB
MD57b795c734b14bd0ffc87b7cebd2157e7
SHA141df36ea441badbdbf10bff05dd185dd2556b80c
SHA2562a65234f6c488081f8ed67d4f417f7bf053b60e3ec0130cc601b09c4e9b529d9
SHA512b418623edb92e28c91407f56c255ba546b5d46a8f3135d9732b4b697f016cccd3b255b2a13f979300d689c41f80cc1e4e322e8ed05e5e86c6d7fc1ef3e74b7b7
-
Filesize
5.9MB
MD51f6778a4a80f944c3a990e9fe026b45c
SHA1a0ce20d466a3be6a6bb1424d2033fafbe278744a
SHA256ff761667da9e37de712e2f7483f69498d1d224ff253b38325f7df6e98ecaf1f9
SHA51260bd715fa8bba819d5f5a515d68c60a339872279a608066a94d1f3f1dfb04029e9fb108ba96f95be23d861563df05f6f175e1239847fe79d9e39c9f468a08a4c
-
Filesize
5.9MB
MD5107c9f8835efe35c21948d50818cd14d
SHA113ef57215b6906ab58f255568a8fc37e899c1d12
SHA256141de55f7765cf0754d0e1a27faea3966bafc45d5e7be4a9ec818025b3e6bbc6
SHA5129a108087a06476497988121ee69139598d9c78d69a7e7af8072eb59536a62c68c56667bf5c5c859b23aee408cbb5433f49bd6478a83a49a36c84f97750ca9992
-
Filesize
5.9MB
MD5e97c72c9a81b8d9147b06c7c2ef80348
SHA17863682be760544921a68e1793cc6f154d4bc28c
SHA256de57ab1ac0c63eb016d414cee2afd8b9a92f508eefbd1bedf24311bd199733e4
SHA5126278dc54cef9273f8bda78887c2958e22912a1df888f4c78a4229765e93497a1201544bad4774abcb83ab141c6c3abdf6b9eca61c12ea641f3ed8223e8b0d046
-
Filesize
5.9MB
MD5da64396e4bdb6d0df416dd2bf3505281
SHA12bc227d318fcca782e649f5a9e9a12c09bc5091c
SHA2560226434381f5f6fd6b69b7cb1ad824b477252a427ba1ed55e4c5c5749bea173e
SHA5123f7953d5394526b0bc7461308b8dfbc1219c64389e07993b68f3b427b1a0c1597ad5ddd332bec4b30a05035632eed720b97a74312c879b9fdfd6d9fce2601bfe
-
Filesize
5.9MB
MD5b4a88f7cd0af45f47279edd6348b0365
SHA1d5535c9c1532dd96ca5ef1d5d2d182ab40d39a41
SHA25674ee59056ff6ffd260a5d0409ce0f4057bbe384c2b9dedf3d67b18fbbd26b7b0
SHA51267b3385bd75c8f6befd2507dd1e3b271f62b7610cf95672fc523771e401cac27dcef6ec61a8e77f3ab177683d44577e82198e4136728ff842b9c7a8ecb832ac1
-
Filesize
5.9MB
MD51ac141f645200138cb27ab9795cf0d14
SHA1c54d154247451b0747dd55155866309e2365c40b
SHA2568cb9f29cd84b9c97d4341628a04d8bb65fab5f86245a62f3df4629dd4ff37b99
SHA5123684678b4be52cbca2389ce25d924ac8f65884d0f63d6c747425ff27abbbed268541de475ca1fdbb2af27576e1f844dd75ff918c645a72b0a6fdaf90a199611d
-
Filesize
5.9MB
MD549d87797d49b152b25f3bc54a9d95d01
SHA15c89b296eb3b7ab1837f27115ea5f255100c2326
SHA256330a8d5f271a1c5d851b2bfd41b53008f838429966873d281851a3a2adbf6c12
SHA51273102e770072e882c93308680265de2cc2826aa62974457624b6c2e7e1c6548b33c2def2ddec78a89203f92973d18ee3dbd3c0e7d1e6b6d9f77a67ff581f9539
-
Filesize
5.9MB
MD5f52fda74478810e2280a3e30962ed0cd
SHA181722a4397e6638fef40521bef78b8bf3748da5f
SHA256d448832425c47390dad45f91b1091ff3ab4d01a3b26d49a01677c26b15e11c2a
SHA512e6d29016b09a3a0e5164f8fd5a92ebdef4ac1e753082dbc641911c87c9d615e98c52f67dea21250073a4f5d70ef1c0f5d9b7b0c3a0ddecdf4d9b8f87359ef41a
-
Filesize
5.9MB
MD597acff96a7f56b979f0e75309991e4de
SHA1ef28b6e37953d6e5f703c2afc7f515cfe54f3e9a
SHA25624ccf1365b3e4b7755d91b6ae70e2862c703be5b337fe951d46ac6152750d803
SHA512bffa9ca50420196e5d2d1ef7212e1113ec449b35fee64d9744012a400fd2f3b394e21273091d7cb15b4674b7ecfa06ab22bf3940a52c4ea9d074c3f5e4545089
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB