Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
01/06/2024, 06:49
General
-
Target
2024-06-01_375fe54900829ab58bd8d72e92bcd186_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
375fe54900829ab58bd8d72e92bcd186
-
SHA1
27530d6c79be5133cca0cd7147dc390bd245ab66
-
SHA256
d36e2dd9ca091d8b9e5e3e60c380bf1531c07f6acd55d656fafe856faae0addb
-
SHA512
998b022f03622974d2d3001c4191fc5a27bb44aefc0a6074df548e7bdd16afe7d6df3d77b9259413a961d170a94492d9738ce111a84b4637c1bbb675131b493e
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 60 IoCs
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_375fe54900829ab58bd8d72e92bcd186_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_375fe54900829ab58bd8d72e92bcd186_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qaFQoUZ.exeC:\Windows\System\qaFQoUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GplJdOq.exeC:\Windows\System\GplJdOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PXsMjRv.exeC:\Windows\System\PXsMjRv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYAOxMo.exeC:\Windows\System\zYAOxMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GBwTjPO.exeC:\Windows\System\GBwTjPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VwAnCST.exeC:\Windows\System\VwAnCST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWPrWOT.exeC:\Windows\System\JWPrWOT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PKycaQY.exeC:\Windows\System\PKycaQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aiENEak.exeC:\Windows\System\aiENEak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mkayeoI.exeC:\Windows\System\mkayeoI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsInDNu.exeC:\Windows\System\ZsInDNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unkwGQk.exeC:\Windows\System\unkwGQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHlHQqQ.exeC:\Windows\System\BHlHQqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lABenGK.exeC:\Windows\System\lABenGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GiRqgam.exeC:\Windows\System\GiRqgam.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApbndBA.exeC:\Windows\System\ApbndBA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTldAPm.exeC:\Windows\System\kTldAPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMpPblu.exeC:\Windows\System\lMpPblu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDVFBCT.exeC:\Windows\System\eDVFBCT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxfVXcX.exeC:\Windows\System\rxfVXcX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTcphYE.exeC:\Windows\System\kTcphYE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD509132c294df432f7f6053c7de0fba3d7
SHA1e439d8bf52465f78cba7d84564bdb7b38b21351d
SHA256d11ca35d0fe2b9fd80e9d1ab3e05884f057389feba34b9e8069ac6817a191676
SHA5126a6ad9bd713b707f9b74c3d10ede12d32d207f15d19dad24650b9e13106d882642fb66727901a598fb5ae81e0b79a4736daddf8eb6ecec6bd35c8f9a99b95195
-
Filesize
5.9MB
MD5343fc9ad15531115f3d1ccf8bf7abd1d
SHA11eb4dded9da8ffdfe388b0bc2dc4f21f9c103755
SHA2567670244036d4b50b51fc4cf3b0608c65fcd9db1907af283012baecdd3311f018
SHA51283fa96f0d07c15b02facf505004443fddec35df964a37909bf7be042cb0279fbaa4db1f57884e6d9e91dc13b50e08d80bf614451c073305585fee370ca47e4c0
-
Filesize
5.9MB
MD5ad5ff85a9661ee4c479953b0b9ae74b9
SHA1c8467781634c572a534cdfe7bff33200cd5635d8
SHA256f1a318ab19a534c62e7798d0e8c02bfa36ba9c86d7c9c76f61ca9134da0359b2
SHA51223db6109a2fd2daa0918da5a33f7f8d168c35ebd8c85d21af6744ff15addb41b8b85e7dfa236d1a33b9323ce0f97e3b23733d3189ef21164c885fe4778fa7909
-
Filesize
5.9MB
MD5d9dfdf5d1f13dd3ed95878b43af4fb3d
SHA1712fc66953d71151b9b4ad8c558d476eae94bccf
SHA256c6ce4facda1dd65525183c3fb5e71997de7e95d553652357ffd94d8bc8276490
SHA51239532e8bb6f1f2d14d091d52cb7a410fe77e5dd73ea6e43bf9e7966b6e7be46958f2678286dacf5c60168c70f830d542b29cdc1b60c1a35f84189b6f3369ff18
-
Filesize
5.9MB
MD5a7d8e152bb668cd8deae0291eba7dbec
SHA1aeaadb5f03c216663252f865dd3c20ccbd2ffdbc
SHA25699db29209a8e16bf39dac9e2160c0c9a900a2a3ebadbe4dad023d5080fc00523
SHA5120b7e94460a05a302fb7b2cd9e6486928bbecaa65278b807a066a4830d3b0b0e321bced4062b89392136a966b4ec0d88994d977f9f2157153c8c310e9405a0914
-
Filesize
5.9MB
MD5ec1fc1740164be463bb4831d4ea37ff7
SHA1810159a3344e278925e8c88486cf3902f5e600a1
SHA25642115993b25aff50c5e8c7b7f86afc9bf1279b200f67f1229ea627bce9e1f169
SHA5121a2731b5ad29741813cc93a16b8dd37d43ca5c22eff2add1d427bbc45deae4960256490cbfbc6a5a81899030343252a0fe4366c6933ba09fb3989d18a2da477d
-
Filesize
5.9MB
MD5e4ceac14845b9c1250dac39b1cc521a8
SHA153995527d8ab0ee7dc46104564225d482212720a
SHA2564574313e3e7cf97cc21d57f6642eaa27ff8764f2b6ce3142ff44eda168daac6c
SHA5122c989e7326a0c3fcd60174da252e21bfd0cec063e6d8510eff1bab5b98185eb22cf1ef632da92057107fc38f67003c235518510b95c085abd4f76c1f8bae8dab
-
Filesize
5.9MB
MD563a2b3476b96515bdd9e97b4dd1c9713
SHA14aa4eaa4ee01657c5f98bff5d75fa72b7f607957
SHA2565ad84a77ce9f2c9f655516c22d226cf02641fec18adf55677e8b49972dd76c46
SHA512b67ec08972741771324b5667545025b395ea9617075eeb7de6d89dd7046de644e81551c2c714811e0f6985399e7aff7bfc7c564030164a7574d0d86f1e3203af
-
Filesize
5.9MB
MD54664fa838a4464fa8803e37cbfbd073b
SHA126e0bb7b952111acfad8a0c416980a75affe9def
SHA25653418513d5921a2d8393b26aefb688348a19f031fe4147949faca908905d3971
SHA51260844f41c0578ea0670e9d424ad306b88d445bc069529764cabdfcc6a2b31ce4fc4e6fc556d2bfb7e435782ebb6f903d789f112906bbcd78b8270659958e65e1
-
Filesize
5.9MB
MD506bc7824ec07a0ee9c378e1a4872f7d2
SHA16b4e06225596f8c2a433c283daf34c624ae0c74e
SHA256cba0c60561f3e4eae97e19aae5d870cf2fa2a7ac9bd4d67e42a70707249955a0
SHA512f044b57fd06228a41cbf1910ff308fff42577ee98a039c30dbb1738f61fb5a3427523bb04c888fb505e0906c6e19dd7805450356788589916b743d772751c3c0
-
Filesize
5.9MB
MD50506721ecb75a3bf80dba982c8509d2e
SHA16a256dac38a57f864607c186fcc7244e27d97369
SHA2561231299ee41582e2eb4df2ba6a15542ce11aee90ab797746374cf3b223ba22eb
SHA51278bf865a3fe0dc07a4e90d39a6989a5548b78971e60d5ee1f9cd3aa39d652c87f5cd4dbe74cf5b07e44e0fe146233a02b849eef340d23a3ee0e2f6a71810f1ed
-
Filesize
5.9MB
MD5bab4e3e2f8e4e8c6cc92d6189d6ea8d2
SHA13a602f8f96f00ce0a53603e02b0a65d10cec6b89
SHA25685ad0a2a15978d0a33adedea37a2b8c2c18f607230170089328b9380cce29807
SHA5123bf0a78304fb376deb59b7b8d7d8374337c7beed52c3f85c473126dd4261fd45db1821df9da6a4586dfd6ac50d5e3dbb5f68aa84493bda4cd29d7b8d8b2147a9
-
Filesize
5.9MB
MD558a54f897fce528bb763cdbcc04281cc
SHA128c6643078234d105a24728bb46944ae1484f27e
SHA25619b8e6c207427787768e81aa8b69554ee2ab63999b7533e317eba5207f867e0d
SHA512b192f18c33ba5515638666b738410a25764a885b8e7d35b6a2c6c6af43f5e36258fa2c5a53e97ce7ac1f8a320220d839a8fe4266f420bd03afa2e594075e22e3
-
Filesize
5.9MB
MD5a52fee08a7ab5fd3b9aa270c63e50aad
SHA1e273b4eceff366953d5d9c58eac664e806675efb
SHA2568f2a0df6e62e0eb64270b31e3d6e595707974badf73c6d9a76253a3f7e07e4ad
SHA51230ec494dc45741675c502329643e396d576e37410e550149426c0c9a82a445fa9cc9a91e1548a73b9411841649b05f0779a7f25c6b29ad52d677eb91adb08a13
-
Filesize
5.9MB
MD570c0704938303ae5ae2d8e90397b70dd
SHA1f78ab13db879223776ae3bbb7e9131d7221b911c
SHA256a20812f5ae4c28ed22201e64fdd78c433f8aca2b6b115d326a65f9074aef4852
SHA51255f35475c38b44331804cbb3b6fae4b95c291c7e54d558e5c3dfd88e2517b3832b8549853c8056d2e06cb47ea5cf86fbf15bff3eb447029ee22604e624a770b2
-
Filesize
5.9MB
MD5610ebe78bdf2045d9d88b5593bdadffc
SHA17f19d15f4e18ad9804b850d5c176d4ecd5758c05
SHA256c367a533fd34c3ca63ca2075eb9c10392fa50738aed09ae175ebf644bafef3e9
SHA51276858309698cfdecfddde0be68fc657c2accd72891e3013ae550daafc17ecf41d93e15138c13aaa7f806941913810335e6a5fccba0d0cc89ed81ec52da0e2ac5
-
Filesize
5.9MB
MD51f635c9af23ada8f1348e3f6747c4088
SHA1bb6c6de6fcc25a4c4179ed8e544a88e5a44a5cd6
SHA2564fe925f383aac23fe3bf66418d01f4f84144e926ed1ae61e99a242446d99ff1d
SHA512d643e3ac0fa8e5b46f188c29a377f85eda7039c110c0f2892ec5a45f3cbe43b28770ed84297cfd3909e280227d8afdcb64ada05765f3ad71c5fd5f07168e45a3
-
Filesize
5.9MB
MD5dd7bf1d36f46c70c942ccb99d94a53eb
SHA1da6265f3eb542b02ee60f605bedefca02a41fec8
SHA256bd6c2a1c12508347f09b2c485c3ff9b170e1176106fe6936d90467a0528c0cc5
SHA512cf5ffc8d85a91702a0b4dc7b83323f4add2765eb1ae82ea114d14e778ca92c82279ed854ce88c6ac1351310ec20909628c129b49cea87a98d58337b12bb039e5
-
Filesize
5.9MB
MD59cc3b8c88b5a364f1ef8cd4a04a6ec21
SHA173764f1f7c382b89f4d4de85bc1cf99572e4ab68
SHA2560a3313e42fc4e0b1b824b02777440121d28a022cf667423ac79824c7357aa25a
SHA51263a262d5af5ee20691e92b8fa11c2a648511421707319a16d513e04c269045642a59782eede2ccc816430fcb67262e374c5b3ce2650e34af319585013a012de5
-
Filesize
5.9MB
MD59b537eb38417138508ba8d23c5290f66
SHA1b71b4728665f9f7dd451652d8caf039a3a509448
SHA256e9319de42494b169a89a1703d078375715414306548f9617f63bde3a7ac195b7
SHA512b7edb2e87e51096a57969c86581d79ba2115ca6cfe3b5b87cf76c06d49d36cca5f3d91f01eed350347f760e971ea7f4a56aac71801f1e0b9285d9fe8ecfaaf8b
-
Filesize
5.9MB
MD53d749b00abe37443fdbf8354e4008ad0
SHA1f15c3ae420e693aab35a62d5835e554249258ce2
SHA25629a2cd97c2141fba88e4407487d38d4fac5183d930cd9f3fb611362e3d2d3e6e
SHA512732c95872291b0f8e194b53d68594e39c0af05be4f46186ff7fbec9fe21a16a02f58a438763d6200a74c4ae3c61e4d64ed7f7cb683e4107191c2dd6629dd0334
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB