Overview

overview

10

Static

static

10

2024-05-31...ke.exe

windows7-x64

10

2024-05-31...ke.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 20:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
  • Size 5.9MB
  • Sample240531-y82desda49
  • SHA256 b91999138cd3ffc2f0be3cffbc1e3ec03e753cbd4cf36ef8d8f3b590e3a69e67
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikexmrig0backdoorminertrojanupx

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 21 IoCs
  • UPX dump on OEP (original entry point) 54 IoCs
  • XMRig Miner payload 58 IoCs
    miner
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\System\UGeJSgZ.exe
      C:\Windows\System\UGeJSgZ.exe
      2⤵
      • Executes dropped EXE
      PID:1720
    • C:\Windows\System\HzZRGEt.exe
      C:\Windows\System\HzZRGEt.exe
      2⤵
      • Executes dropped EXE
      PID:2624
    • C:\Windows\System\lAsRmhy.exe
      C:\Windows\System\lAsRmhy.exe
      2⤵
      • Executes dropped EXE
      PID:2684
    • C:\Windows\System\KYsErUN.exe
      C:\Windows\System\KYsErUN.exe
      2⤵
      • Executes dropped EXE
      PID:2608
    • C:\Windows\System\ZeyXPQf.exe
      C:\Windows\System\ZeyXPQf.exe
      2⤵
      • Executes dropped EXE
      PID:2600
    • C:\Windows\System\hVvnCvN.exe
      C:\Windows\System\hVvnCvN.exe
      2⤵
      • Executes dropped EXE
      PID:2968
    • C:\Windows\System\BlnrYkl.exe
      C:\Windows\System\BlnrYkl.exe
      2⤵
      • Executes dropped EXE
      PID:2712
    • C:\Windows\System\kErrGcF.exe
      C:\Windows\System\kErrGcF.exe
      2⤵
      • Executes dropped EXE
      PID:2532
    • C:\Windows\System\tQYGMJg.exe
      C:\Windows\System\tQYGMJg.exe
      2⤵
      • Executes dropped EXE
      PID:2544
    • C:\Windows\System\kNyPYMy.exe
      C:\Windows\System\kNyPYMy.exe
      2⤵
      • Executes dropped EXE
      PID:1088
    • C:\Windows\System\Jccbwhi.exe
      C:\Windows\System\Jccbwhi.exe
      2⤵
      • Executes dropped EXE
      PID:2128
    • C:\Windows\System\Umveuhb.exe
      C:\Windows\System\Umveuhb.exe
      2⤵
      • Executes dropped EXE
      PID:2540
    • C:\Windows\System\lCzfNeR.exe
      C:\Windows\System\lCzfNeR.exe
      2⤵
      • Executes dropped EXE
      PID:2156
    • C:\Windows\System\gmvsfRO.exe
      C:\Windows\System\gmvsfRO.exe
      2⤵
      • Executes dropped EXE
      PID:1740
    • C:\Windows\System\WpJagGO.exe
      C:\Windows\System\WpJagGO.exe
      2⤵
      • Executes dropped EXE
      PID:1552
    • C:\Windows\System\ONGRzrr.exe
      C:\Windows\System\ONGRzrr.exe
      2⤵
      • Executes dropped EXE
      PID:1816
    • C:\Windows\System\iyVhzod.exe
      C:\Windows\System\iyVhzod.exe
      2⤵
      • Executes dropped EXE
      PID:276
    • C:\Windows\System\yyvwJfX.exe
      C:\Windows\System\yyvwJfX.exe
      2⤵
      • Executes dropped EXE
      PID:1712
    • C:\Windows\System\VmDPaca.exe
      C:\Windows\System\VmDPaca.exe
      2⤵
      • Executes dropped EXE
      PID:268
    • C:\Windows\System\yyZcCEb.exe
      C:\Windows\System\yyZcCEb.exe
      2⤵
      • Executes dropped EXE
      PID:2384
    • C:\Windows\System\MxwyMjn.exe
      C:\Windows\System\MxwyMjn.exe
      2⤵
      • Executes dropped EXE
      PID:1448

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        KYsErUN.exe
        • Path C:\Windows\system\KYsErUN.exe
        • Size 5.9MB
        • SHA256 b69923e6559b64f6ecec4c9d15032fa3a50ee0dfaaf66627af3fd853043c9627
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UGeJSgZ.exe
        • Path C:\Windows\system\UGeJSgZ.exe
        • Size 5.9MB
        • SHA256 a3ac56f0d6db8e494ff81fca060d15ca740103c4f80471ca2bfc66c98759728f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VmDPaca.exe
        • Path C:\Windows\system\VmDPaca.exe
        • Size 5.9MB
        • SHA256 dd4867cfee8a2c15b5cb2fe94a9ce42d57232d6eb2d3865434985bce38a416be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WpJagGO.exe
        • Path C:\Windows\system\WpJagGO.exe
        • Size 5.9MB
        • SHA256 2ced931af154d9ccdcd694ef39330b3c6bee5f9ebf3f4cf9104c2cc32ce3565c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gmvsfRO.exe
        • Path C:\Windows\system\gmvsfRO.exe
        • Size 5.9MB
        • SHA256 df29ab5d9aabd4ee0c631321793300205ca6716cd2e9f2289f4a995de24f8b84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hVvnCvN.exe
        • Path C:\Windows\system\hVvnCvN.exe
        • Size 5.9MB
        • SHA256 38cdf37c31276233cd61cc3dd0c10a125ece167e4c63ccdafb97ff3c5866076a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        iyVhzod.exe
        • Path C:\Windows\system\iyVhzod.exe
        • Size 5.9MB
        • SHA256 8f37388fa0a66c8bc2fffcbb925bb2286e9cae86f0fc55386a551a84d76d888c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kErrGcF.exe
        • Path C:\Windows\system\kErrGcF.exe
        • Size 5.9MB
        • SHA256 242d995e8a64f3fdaa57e4bf52d658a12857066c432315f0c5bda9a4770677e1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kNyPYMy.exe
        • Path C:\Windows\system\kNyPYMy.exe
        • Size 5.9MB
        • SHA256 80c61fea0eba3b04c04aa1ce43fd8a4e42b17d6c2006221f770d932fa0581065
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lAsRmhy.exe
        • Path C:\Windows\system\lAsRmhy.exe
        • Size 5.9MB
        • SHA256 045691b0204d95a97f3077bd441f89f11c3698f4d128db977a85a4cc112546f7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lCzfNeR.exe
        • Path C:\Windows\system\lCzfNeR.exe
        • Size 5.9MB
        • SHA256 2f5094b79636950e99a5365a0c24a32b6d4be1a2cc030dc911bdfcc41901ee56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tQYGMJg.exe
        • Path C:\Windows\system\tQYGMJg.exe
        • Size 5.9MB
        • SHA256 c2c4cf0c1bf094f3d577b2dd05fdb790c27bafff187354e2261b37baf6df79bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        yyZcCEb.exe
        • Path C:\Windows\system\yyZcCEb.exe
        • Size 5.9MB
        • SHA256 4a4dc23f235e5eb8d52aa92f9b039236f197c703c9e4ba57e312432aa15f283d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        yyvwJfX.exe
        • Path C:\Windows\system\yyvwJfX.exe
        • Size 5.9MB
        • SHA256 d4c8c30dd8e1b06b7d2b2e97a1ca8149fbe14c9f450149f65bf83a09f7f4a9d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BlnrYkl.exe
        • Path \Windows\system\BlnrYkl.exe
        • Size 5.9MB
        • SHA256 1f956d1a1c9014c9830b0b6190023d6323aeb9d1be8fa0acca6617aa134f9b41
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        HzZRGEt.exe
        • Path \Windows\system\HzZRGEt.exe
        • Size 5.9MB
        • SHA256 53579e9875aea1976b3e72bf47b764d3c07984496c6b13c12d5375e64f5c8691
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Jccbwhi.exe
        • Path \Windows\system\Jccbwhi.exe
        • Size 5.9MB
        • SHA256 b2e017a0d7962b1f459991d7739d13d5ed81b86bbf1c7028659513d81a81d65d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MxwyMjn.exe
        • Path \Windows\system\MxwyMjn.exe
        • Size 5.9MB
        • SHA256 0e394ad74d08a6c43aa0730b33c3054d778877fe6e6106dd95e5269e06f65435
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ONGRzrr.exe
        • Path \Windows\system\ONGRzrr.exe
        • Size 5.9MB
        • SHA256 a5cbc2c8ff6a35ac035a9de29c361a81210d7106d866a71cfe34bcecb69a8ebc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Umveuhb.exe
        • Path \Windows\system\Umveuhb.exe
        • Size 5.9MB
        • SHA256 29551617c1eaae6e44456b3b2341f9865704bfb9789c4f7de5de798b2ad23428
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ZeyXPQf.exe
        • Path \Windows\system\ZeyXPQf.exe
        • Size 5.9MB
        • SHA256 0ae342b2a30b051c1814f5074113233ab4c6a2d1c45f214e9a91c99855da1522
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1088-72-0x000000013F9E0000-0x000000013FD34000-memory.dmp
        Download

        memory/1088-152-0x000000013F9E0000-0x000000013FD34000-memory.dmp
        Download

        memory/1720-143-0x000000013F720000-0x000000013FA74000-memory.dmp
        Download

        memory/1720-9-0x000000013F720000-0x000000013FA74000-memory.dmp
        Download

        memory/1720-57-0x000000013F720000-0x000000013FA74000-memory.dmp
        Download

        memory/2084-139-0x000000013F9E0000-0x000000013FD34000-memory.dmp
        Download

        memory/2084-87-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2084-18-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2084-140-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2084-47-0x000000013F670000-0x000000013F9C4000-memory.dmp
        Download

        memory/2084-71-0x000000013F9E0000-0x000000013FD34000-memory.dmp
        Download

        memory/2084-74-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2084-49-0x000000013F090000-0x000000013F3E4000-memory.dmp
        Download

        memory/2084-26-0x000000013FF10000-0x0000000140264000-memory.dmp
        Download

        memory/2084-141-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2084-1-0x000000013F090000-0x000000013F3E4000-memory.dmp
        Download

        memory/2084-103-0x0000000002380000-0x00000000026D4000-memory.dmp
        Download

        memory/2084-7-0x000000013F720000-0x000000013FA74000-memory.dmp
        Download

        memory/2084-0-0x00000000000F0000-0x0000000000100000-memory.dmp
        Download

        memory/2084-142-0x000000013FA30000-0x000000013FD84000-memory.dmp
        Download

        memory/2084-112-0x000000013F7E0000-0x000000013FB34000-memory.dmp
        Download

        memory/2084-111-0x000000013F7D0000-0x000000013FB24000-memory.dmp
        Download

        memory/2084-113-0x000000013FA30000-0x000000013FD84000-memory.dmp
        Download

        memory/2084-42-0x000000013FAF0000-0x000000013FE44000-memory.dmp
        Download

        memory/2084-35-0x000000013FD60000-0x00000001400B4000-memory.dmp
        Download

        memory/2128-80-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2128-153-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2156-106-0x000000013F170000-0x000000013F4C4000-memory.dmp
        Download

        memory/2156-155-0x000000013F170000-0x000000013F4C4000-memory.dmp
        Download

        memory/2532-150-0x000000013F850000-0x000000013FBA4000-memory.dmp
        Download

        memory/2532-58-0x000000013F850000-0x000000013FBA4000-memory.dmp
        Download

        memory/2540-88-0x000000013F320000-0x000000013F674000-memory.dmp
        Download

        memory/2540-154-0x000000013F320000-0x000000013F674000-memory.dmp
        Download

        memory/2544-151-0x000000013FD30000-0x0000000140084000-memory.dmp
        Download

        memory/2544-64-0x000000013FD30000-0x0000000140084000-memory.dmp
        Download

        memory/2600-36-0x000000013FD60000-0x00000001400B4000-memory.dmp
        Download

        memory/2600-147-0x000000013FD60000-0x00000001400B4000-memory.dmp
        Download

        memory/2608-85-0x000000013FF10000-0x0000000140264000-memory.dmp
        Download

        memory/2608-29-0x000000013FF10000-0x0000000140264000-memory.dmp
        Download

        memory/2608-145-0x000000013FF10000-0x0000000140264000-memory.dmp
        Download

        memory/2624-70-0x000000013FF60000-0x00000001402B4000-memory.dmp
        Download

        memory/2624-144-0x000000013FF60000-0x00000001402B4000-memory.dmp
        Download

        memory/2624-14-0x000000013FF60000-0x00000001402B4000-memory.dmp
        Download

        memory/2684-146-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2684-78-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2684-21-0x000000013F920000-0x000000013FC74000-memory.dmp
        Download

        memory/2712-149-0x000000013F670000-0x000000013F9C4000-memory.dmp
        Download

        memory/2712-50-0x000000013F670000-0x000000013F9C4000-memory.dmp
        Download

        memory/2712-138-0x000000013F670000-0x000000013F9C4000-memory.dmp
        Download

        memory/2968-148-0x000000013FAF0000-0x000000013FE44000-memory.dmp
        Download

        memory/2968-43-0x000000013FAF0000-0x000000013FE44000-memory.dmp
        Download