Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
01/06/2024, 02:12
General
-
Target
2024-06-01_abf808c3f8aa3bb4ffda0a555b260523_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
abf808c3f8aa3bb4ffda0a555b260523
-
SHA1
6f94e61ddde900a8fc0705acb4cf0b9532216213
-
SHA256
d48bb218ec8749cdffada855ef9f6a973c451485da0385bce12317ef9fc79ca9
-
SHA512
41560139420429c30c71501a90f696f4a47a297f58adad1d5615d9995b60f004a21c809095466d433f304031f6fca53aae319b6ba3ceb65328df0954e719b3cc
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 53 IoCs
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_abf808c3f8aa3bb4ffda0a555b260523_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_abf808c3f8aa3bb4ffda0a555b260523_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KWBODKl.exeC:\Windows\System\KWBODKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yeVozfe.exeC:\Windows\System\yeVozfe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUjLxlm.exeC:\Windows\System\PUjLxlm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHQsJgc.exeC:\Windows\System\IHQsJgc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULQKosb.exeC:\Windows\System\ULQKosb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OigWIyB.exeC:\Windows\System\OigWIyB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KziynoP.exeC:\Windows\System\KziynoP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojTwSQW.exeC:\Windows\System\ojTwSQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yRSJbka.exeC:\Windows\System\yRSJbka.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\scLJBKw.exeC:\Windows\System\scLJBKw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTzUtQV.exeC:\Windows\System\YTzUtQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MEcxGin.exeC:\Windows\System\MEcxGin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlulgTj.exeC:\Windows\System\NlulgTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUtOlVE.exeC:\Windows\System\sUtOlVE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmtRphF.exeC:\Windows\System\UmtRphF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBspvQu.exeC:\Windows\System\bBspvQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UoioNTL.exeC:\Windows\System\UoioNTL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FymBsDe.exeC:\Windows\System\FymBsDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ROpSQra.exeC:\Windows\System\ROpSQra.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfdTVhG.exeC:\Windows\System\jfdTVhG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLsPFqh.exeC:\Windows\System\HLsPFqh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD554c99e9ef769fc023fbb68dbce1e7d79
SHA19ee5e2e7f66da6492e59573c2ac133cc7ea7b4ac
SHA25632836c6486f77f1bcd61116cbd90b39c3fca0a63e5be15551e95a9d17d911fa8
SHA5120b113a8dc64828e045832745844d2487fdcea057846f66724c26ac5c990c5cf2a0e3c0feca8da2ec05b0b7d84aa2c44e2be9bc32c5561f7716a3110510a13d81
-
Filesize
5.9MB
MD58099351dd5cac8355d7c9ae7e3d41dff
SHA1586eb8e92badfd4c58230e95a4a4af4f458de596
SHA2565c30559c6551576539afc984b22a24bebcd0c55f71b6b2d07f9116e4c4fd6ea6
SHA51203df95f83477f6ea34e7df600e2047a9c871834b6e4520d0203d65af031d6f8d3621add524834514460c3ddaeb88a374bea3ca2200bd08c0d92ceba28cf7ef02
-
Filesize
5.9MB
MD5b53760842f8c6190c625cda19f98afb4
SHA1a578352008fa8faeda9bba62634d8711de040cd8
SHA25676b984df2aabd47c33c806f80ea350907a495f3a23662d726e916883576ef60b
SHA51287808ccf4729e48c9ad4c7441b32493bc7f483f9af5183072923d36927903205186c24e648af9fa4fdb52dd6e101a87da0995198670e2b1ea16fe1d24824c888
-
Filesize
5.9MB
MD5f210c93e358f6758c3c2ed93db65ac58
SHA13cb0071ca69a64ebb424baf36915afdb5de44ca1
SHA256bcefddbcda34704b5361e7363ff4f9447b614303f3196d14d6a515ed9969b82d
SHA5129c500f4912669b65405d6fda737f144a89741edfd8d9cf339311f227b362652b000d15f9b7cc6559a84ad6195ba89b1c0c627b87d136ca00d72b9c13f6aaab31
-
Filesize
5.9MB
MD53a959f8f3ebe1c92e8e66b8ab5f894da
SHA169d4438c2b5ed03c3ee659b54151e100c44fb270
SHA25664d29ed88ac0a7122a93fad908b8bbbe237c50e5846beb54f261752a63064190
SHA512b1f4733ff9e30f3796879a9e9907f0cf51ab8d63f7862802e12e8adff6f05fe899eb55641d2c24aab5bfc204dae0c9e4e0f3a2ea04bf2727177151df7fc3f2af
-
Filesize
5.9MB
MD5646a69ecd3569ae7f19e0d7f7dad40b9
SHA1e32c70c607078d338a11eb0ea75fd07cb8384579
SHA2568fa0c6116c654136536bb5192284852b9e0c18d79bdff37d721d614cb5c2b809
SHA512860c63d8e6db3b8b0d4303727cd6c994e235a4083f0a7f286db33100dc1fda83822381c9fc3962945f520c491991dc803352ef9eb7a8e56c4f005f4985073395
-
Filesize
5.9MB
MD521f25762dcf3deaac990dd6cd6c5f850
SHA197385155b820b0a14f830292e82c38e86a6b1928
SHA2567459537c669ba645ebcbdbd91291da3a8be57d048b726a4e77c3075d3ee17af6
SHA512b137b578fc8aef2009154e598bd62a8b10a1e4ad729cb4f252c12deb7e10d3d126bbde17f62fc0891e7c7d59173e6c5b3e320543386c18f50542f1bdc3f3b542
-
Filesize
5.9MB
MD5e88f292affc76333228401893c519ed3
SHA16c9c9a458afb21dd17a5acfc392dbfdd56a29086
SHA2561d8925de89573d57511a627234f7fbe814c202f1da9cc130cf08b065e42776b2
SHA5129022b8196e48703d406d5ee1db5c00a5c2ebfa1831fe2bc0e64c018657e05f570d3c37716074fe328937caeaa199aed3d51fd55686fa2ca250deaa44727777dd
-
Filesize
5.9MB
MD57f379015f637e0f0525ebadef6521070
SHA1e4144c12567f58968cc19a5d528382ff3b273ac7
SHA256b7964a51c7b09bba9e6cbbc72602d9ee1ef6cdf4636eaf94e5f6795d59ec1046
SHA5128c13df5643725f8c6280c40c4b6173d1c67eb1fef79199412623e4ab766b489234ac2854f08f259a5932966e1404aee4af181ad3548f8071ffa5acf65d4a65cf
-
Filesize
5.9MB
MD5741cf5fe853b1c8b6a1e55d00afc9871
SHA1a9504171bad37ac8a30a0f585d1379d4a0308e5d
SHA2562337316d664f8b179c3cce545d06a530f94b2014951964302e7ab6fb05f7c9bc
SHA5123655f66061bad2903bad2d91fd61d55ed7f20d86167d1deee6ec7b36b31a4d2c928a4f0cd06d32705250279ff52c56fb2cedc4b52b6116f63912a5d05fd5e09b
-
Filesize
5.9MB
MD5939d62afb05eb1746bb2499dc5caa6b8
SHA1516369df39e5288abd000837246005aeb4110322
SHA256478fd249b13d86f556641521b72442bae18d6db169bb794339dac7e3f6c7b95c
SHA512e6dac55531d6e2a28dd5be90cb8eb5ea9ee7bceb8ce4a2c7809831d5070de1f36ed6ec47dbdc002cbf4db6922e8f2b2b5232cf5f85c37f42f5bc7aa55a911ddd
-
Filesize
5.9MB
MD5774688d300dae941e48f3791f81b8976
SHA19f1b70fbbf8d342f4258dcb45753a57ab44017b0
SHA256ff5be47cc2bfb5bca9e571cfcfe7eaf299fce4c0c6249bfcb90c820d3990e4fe
SHA512f674c266e2fc7b6768ee0a5202feb390b9e4a4b7941e80823d3f253413f97b3baf8f7d051321df9a03efc273e9ab5e84296d894af9199be3703a748347adae86
-
Filesize
5.9MB
MD5f31ed82f49c2a7b32486137049ba2dfb
SHA1cdcdc10e92de25c00a4158e76950fa377060e157
SHA25631856a8a3dcbbe885665d633a716321728913555199b47e9ab150d11c3b7dc67
SHA5122445259ea7b1e98a14d436ca3a037f9ff3149d0c5af88cd8bb723da66334c8f5bcafead8ec7c66221aaf9ef00b250b97387ea9c48252ac67315b4d162d56ce90
-
Filesize
5.9MB
MD52f2ba90f90026b4276ca5ee778513d52
SHA193353fe2a9efb19a2b1ff676b9596927d7fcb197
SHA256cb8e33671a93ac276b5a26a510c30fcbd19cb11fdcfd0fa85bd26bda7732eaf8
SHA51206267a8a2909062fa2dac9927d18ac6ab066cdac0ce24771bf34b547867293de281e29a4e653054f5d5c755ce7cdae199d98320538b7eb0458c0e75829d36bf7
-
Filesize
5.9MB
MD532b15dd93146f838fbbdae860dd2998d
SHA1b7011e11f682f41f0eee3a0426477accdf2d9c0a
SHA256069cc3959f5594286571bb9600c56b68a28c88000250b92e4ed6056289b53db5
SHA512a6b98dfb070c445915e0931a06e9f88cb4822b933ccc7cd4f4ea588b8c06acb450ba84b351d590e31d3972434182cbe66e78acfb50b99098d4cb231ab650e682
-
Filesize
5.9MB
MD53c9de06f8a149b7f77eb94fed8938e6c
SHA16591a73b8d05e6978edfc4ac76960b80440a1afd
SHA25663024aa787716f0f47be3dbd0231d0b5ee7a4f49fc18835bd497c65d2043d3f5
SHA5120e000760d30bf3ab452dd26c2b0a3aabf4c37e0581720f97e4c510cc2a3c5263bc5e996013c7a177c4c5d5cf93e266b2ea84dfb085b107a19d7dcdb472981aef
-
Filesize
5.9MB
MD51ba934b36bf991f0e6acc55cc826dfae
SHA12963fabe74316feb14d539effbd63fcea65aa63a
SHA256cc57de283b82deabb635694fa47fec1ea35dc08d65965861571f671d56240b48
SHA51202674fecdf6ccd09498a632f9f0271c9c45c248e0464bfff5e026777b54129159fe7bd72c742636b6488c12c446367d2fd90ce0b169342cbcba2f3eb596c2b46
-
Filesize
5.9MB
MD57223200ee6876ef35d70ec397de99287
SHA1528cf74cc2b1ab69c95f3ed25e45671884322547
SHA25694610af7583be46aaf6ccedc7b96331680946c6a9ccb9f818e06479c5564bacb
SHA5127e5490d3bd24ebe411eb4426c43ec132e1daf08e7fd46b9da2f5d6c52f4070b1aa25bfc9e8c7e03c4a5b9c388d20c49cbeb3932b28396cbfa1f98227be224d11
-
Filesize
5.9MB
MD5d3f900325ec34f4390d3722e27b96754
SHA18e07443588fbf61c37ceaf770a24cb6fb7d5b7ea
SHA256e5d803830a86855adf94f098eeb175905e01267eb403adc8222e5aff5cce0a7b
SHA5124b99030c6ca27c27bd622838204f4c2858edc62046ef44b15d06584f0bbeaf1baf0956e31b81f98f56ac59eba52375fe94e7a01e9b774501aacb57c3e851f218
-
Filesize
5.9MB
MD576806b7bf642b36a5a6fa144b0d8cf9a
SHA1ad1d324d666d47663dcbeecb511b0ec7b6084773
SHA2565021b4bd7dcff0f4247794ab608e9abcaf8ad254965f802c769ea6cb5263f5da
SHA512992f7c67c538b1a0b5a7a9f1c01208dead1957ea5075be51b4744a860ae8dd21612d68613c1691cc819a56d0890f238f09f59d2d53a9592a9c7e2ab7f9f1b9cd
-
Filesize
5.9MB
MD512dc43dbda4d2c57cd7a57227cf2a5e5
SHA1ddfcb4d31e3b497eeb7e4cd8891266fb50dd84f7
SHA256aa6077dae07d3a342f27703d31c7b59f89cc06051c85e8d3e9b03c30d65f717e
SHA512bdcdd5206bf6638d747d5fb6ec028dca2c4ab28a39c0dac2881cd4d8a3cedadd123d880f56e019178b68b9c91f755e58f2666494724a3982d04bd491dce336d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB