Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/06/2024, 06:49
General
-
Target
2024-06-01_375fe54900829ab58bd8d72e92bcd186_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
375fe54900829ab58bd8d72e92bcd186
-
SHA1
27530d6c79be5133cca0cd7147dc390bd245ab66
-
SHA256
d36e2dd9ca091d8b9e5e3e60c380bf1531c07f6acd55d656fafe856faae0addb
-
SHA512
998b022f03622974d2d3001c4191fc5a27bb44aefc0a6074df548e7bdd16afe7d6df3d77b9259413a961d170a94492d9738ce111a84b4637c1bbb675131b493e
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_375fe54900829ab58bd8d72e92bcd186_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_375fe54900829ab58bd8d72e92bcd186_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uKZvHuR.exeC:\Windows\System\uKZvHuR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bYfRfxf.exeC:\Windows\System\bYfRfxf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yObrscy.exeC:\Windows\System\yObrscy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfeZSwZ.exeC:\Windows\System\hfeZSwZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WctOEwR.exeC:\Windows\System\WctOEwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YGfbQAf.exeC:\Windows\System\YGfbQAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SHEcGEU.exeC:\Windows\System\SHEcGEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iSjYXSt.exeC:\Windows\System\iSjYXSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cLEdksm.exeC:\Windows\System\cLEdksm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GKrHfsl.exeC:\Windows\System\GKrHfsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEoMqIp.exeC:\Windows\System\vEoMqIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uFgmuyb.exeC:\Windows\System\uFgmuyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPBTsvC.exeC:\Windows\System\IPBTsvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONGJtlg.exeC:\Windows\System\ONGJtlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGCgkpW.exeC:\Windows\System\FGCgkpW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNQrkkC.exeC:\Windows\System\JNQrkkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sTzUWlR.exeC:\Windows\System\sTzUWlR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iQMPjCI.exeC:\Windows\System\iQMPjCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdVRsVs.exeC:\Windows\System\XdVRsVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhNyTZc.exeC:\Windows\System\GhNyTZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nMjMpjV.exeC:\Windows\System\nMjMpjV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD534f84c23abefda00ee796a535bec5d21
SHA14a23d2b042db26392e6e78c2a02697404639e3ca
SHA25692aacffad523b7c81956de2e26ea88454efe92ffafb510cac2e19d57c77f75ce
SHA51240167337d3badff7ddcd09ee8059b79e2e9a0afc9ecfd61dd2070e4801c03e480a7ce17e03a208dd8aa46253281bc02847b12001da8db69e4d2486e0b96ca11b
-
Filesize
5.9MB
MD5320d0b4d8877e3bea3e1d0e45bd4bb69
SHA14505a5d1de6ccbc8d0a286a8d53f8efd48cd9393
SHA256e9d549846af7e3151801479ae0c37c81f13c64c7ffcc2386c4e29205a8e57f95
SHA5128c36011f328e06e07ca80b8ef04b38a673ce27facdf86d94f57c9d2b4a429917bc37a145bff1a7e2cb53aabe632393f2c7e046381636122ce740ad562a980a8d
-
Filesize
5.9MB
MD5aa5bee9658835d7db0d8115de8d103c0
SHA179d97ca0d2ddfa561d554e306ee9f83571519e30
SHA25687a6d5c8f27838078b759123685d0859c6c1d3f1d36a6643ec791df2c14e3ed5
SHA51253538ef8c9ec2ef8caee1d94068ac53bd71fa40f5670af8fd5881fa4d66ac2576356c192ae8f586e4319c5107f59c013f2b6a6631220a4edd892b8b5d3c1061a
-
Filesize
5.9MB
MD55effb4a49371f23eee88e70da4234a81
SHA117a26e1f9c6d267681f2cccb2506c780353959ff
SHA25686f51e6d68ef23dff74f246acaf69ced1ad4d150142967febc005539b9a3305c
SHA512c93d2bba5d849c7acb2299bb40bd3e7f84029d8518c3cd9768efac2744247fdc20bd9ed5b184e2ca59c136e9a9db9d63a6bc3797cfe5aa53a4ac83887b36883e
-
Filesize
5.9MB
MD53f3d196a232c194df4c18b850ee39893
SHA186a84d89d6ff3bad3f3437b487f853e386229f1a
SHA256ed62d92d9da77280fdefa709073f4345b6140289a70e998ccc18cb80aa481f51
SHA5128a849ff2ba47f85ec32195841079803044e70c87bab569ee169c2cf29bb6995fc0614dad460b354d39b8c99232aa65ad38f9842090f2a4b2032108bac9abd5a0
-
Filesize
5.9MB
MD5d1d1b57d7118702d4b0bdc90d934b525
SHA1223ae7d2bf84bc0959dfe89eb7153b757c9ec3ae
SHA2560005cbed3e2a4aea7eb380e43f7eceac747e6cf1b9176884fc0c482b6d8d290a
SHA512937f0e022c895ff9c40db94e93b9ebcd03a5adc15080b1171d3ea0ea5b83a12f1e8fd6368245c8ca39006545b9cf9cae74acb3487920c2166e24e4ae7542a972
-
Filesize
5.9MB
MD56f03e858cdd6cded2085152ddc7bdd1f
SHA15c89148845221abe6775d1671b550dfb6f8b492a
SHA256161cdd8727fd4cfb879ee44d006528c5e78029451c1ec21397612f02ce94b96a
SHA512ac30a8a60580d79f3eb75b345d14e37c1b9ca3bc455bb9884a77a50b8805c12d46c0c98192d8d3c8f70ec8f1eefa23aa269c709987d7c013b1531ca69f9a1cb1
-
Filesize
5.9MB
MD5bd40489219f701f978fdfda3c667d802
SHA17e56a5fa79b9a50d22514ed23de302295de9d8d2
SHA2565255c20aad4681c7fa537df73dc022855fb60b7ba16c24f12a2489e96a4de366
SHA512eff9db994b48612703389fbc3d8a9de12183842ce2e9d9fdfc6dea0463197bf5628aca94ce2d24e92055e349dc79373da281093e029303ff5845da1e8b5d2244
-
Filesize
5.9MB
MD5b89ea1ef2fc1b9d26307996d3e1686bc
SHA1032539d47225ec90a785acf7a2b505e3952681ff
SHA256e4379fdfd7076e9007aa2d3029885e8116ac58da0875b74547deb0f16d56394e
SHA512c6cc0d210ab849abd62b35bb56cb3aeea24ca6d6e8716b20d6408b8be6d0d1d027a6ae411f1cb7baa21186ff8b12a304c36ef5c270874a2a081810f79560d088
-
Filesize
5.9MB
MD5bde60cc35cf5b14cf7912100918c911c
SHA1b9ab1a81fbcdfccca66f4b0446180ccae63e6cbf
SHA256d49b206f9ef943847d60ed6270b5146b3fa183acec3ca41cfa5db3f69e5f8c52
SHA51254d5def7609e5b0cd186b45636d27c472e7d14c534afce47a4617c8b8e2fad3622c676a96a76aaf8ce71050d73dbf3bbc191cd1288e1c3ad50971480389e36cd
-
Filesize
5.9MB
MD5b7a673d7ce17f9feefccd1f7650d7eab
SHA18f71fd11e16e22a4551283ce99338f1e7fcc1ba8
SHA256d8805d4a15fcccd571fa23a9400413e3e5f712b5d9c7b6f44d59bace1cb2661e
SHA512cc6b4704d1bbd8328566a33ff323768179feca2fbfb5ae711d9f8779ad5dcc9cb3d4c3e750b215495fb0fbf42c1300909c539f3fc71aec23ab7b7df6d8ec1fa6
-
Filesize
5.9MB
MD50601a3d754150983e1aa4a8812996c5b
SHA1118bc75a211b845d1a5056ad3842571210a437e4
SHA2561ad782cceae08c65ac13bde0c4ac25a7f95b8d060481a3dbd5a9e89d1e43ef51
SHA512e47a9fe5a7defc03aff64b6180ed888cb52a6f0af8c89e28798e659386fc509bf87f29c032f7574e1ee6c07994c3ef38fe4cc495bbf1606b1b7262e7c83d9217
-
Filesize
5.9MB
MD5c44e99853429f8aaa335dc2d5d1503ce
SHA1800f750bfa456704541a55f2cc5eb687dff0626c
SHA256a9d8d84dafde1917335c55723137407b9b77e4820aa9c0d6b865617cba94d1ea
SHA5124ab1ccfa660ddd4ebc93a21739a7c6d5b86b427c43c4507b4b8de52e81f5976920921587b02ed857c5c491668e829b6c21782e693c5a5bfc881db05c29ac220a
-
Filesize
5.9MB
MD5b071cfe9300fbb425373d49e3cde91dc
SHA122f5d423463a4ccb9daa06d5d4973e4e21cab40c
SHA256559332b0a19a2dd8398e59a76faa7204cbf301a294f2d9501e7744b8238bab3e
SHA5122ac409fd1dd1c1b0b2ecdcef8c542f15ee24f95d0880862060224f5a24278476838998755059af6e9ee631336d1f624a5263603438e71c5c356c3c3392dced09
-
Filesize
5.9MB
MD5180e856586a517e3b9c26d4ca60d69bb
SHA1d9163b61c17941e0cda056d2622d7380bda48dd1
SHA256f01c04ff2124d2e539b02314fc534b0bf5d7e4a75975dfa5f986e0866ca7ef13
SHA51273721326fd3728549c56a1907950289827ddb8c69a027aa6829b634d399264e52d6491d78b69480d9b2820e92f73de1729becbe924ea2a56dbc478ef928fd8a0
-
Filesize
5.9MB
MD5f28f7aaf5a1008aab2d26aa2dec28a7e
SHA191e79987c6635ca1a561ec4292d3941db7cd63e3
SHA256ca77d0ef1c2323b5636aa0599955399a365767ad22d69a1ea84f1e52f0142d90
SHA5129406f99165e0e05d4b4d71c916efcfd058b5af9a6e0a9925cae530231b651cd299a3102336f4b385f2f457057dc4917fc24d8f3380888c2030be30efc63d2526
-
Filesize
5.9MB
MD5dc287d2b224f43babd0ed25f75d555fe
SHA129ec4bee30537a2b7d115fe8b0f5864442c834b7
SHA256bbae0a0866b3dff31e440e6f41385a54ac034660ef38059b6df1cf5d37d11a2f
SHA512558a0ff3e7fe8df9181306a80deb0cd456c37c0ce93607caf4f21fffe798611d4e0ab2b2499246fd6a17b2bb4573f25fec044856d8782470745ad7ce316afef2
-
Filesize
5.9MB
MD5a552c236162b4288c7e63fc7c3bdb6b6
SHA1fbc968f275bd10a61c0dc0c93eeeec37eda39d49
SHA256c7aa044a9591bc6434a17f8740c743416c1200c68961c870e0aa9dfbe69d2073
SHA51207af653aaf9eca032f1deeb5e264e6abf1a0b18c7066b3211d7cd90d24b45276fd8e9cd6722c6c23e53e951378a7e20f228bf5af86992451207bfea01093b01a
-
Filesize
5.9MB
MD5fd88a2bbe83a3d1e2046ac9adf80852a
SHA1db9b2683313d9ef15fac9213942f3cdf0f1e2d33
SHA25674ad716ef3ba645aae26794d1350d6e223beeb8d09362f1393f3a4d4a8756b5a
SHA51276c778d233d371350abe070b7f6f37fff7484d3f6a1dbfced19df35d468dcdb8d13ed96f656d798f064dab7e9826d5a92ec4b550d89862afff009161893963f8
-
Filesize
5.9MB
MD5f39c5430872ed76df6a333043e350118
SHA1a77bf658911d56293b471af99126bd48ceea43bb
SHA2562812b6bbe823d5a5a78ab888e2cd87b6700f3425988cf1bb0e12e667aef8b5bd
SHA5125dfad663844a6b1585361b4fd9a56331cc9b6a790aeaca4972ea57f6e4bea981da047bf0d80d98cf327d0ab229261ada34a3969677264412f30c6615c9952444
-
Filesize
5.9MB
MD5488b3383dc7f6be1bf71ad631d3befa5
SHA18e54380533cfc5a15f4c329670146b3b3bbe0f6c
SHA2565f43b78e0c4e3f8fabab239cd0efff5c378ba64598a7721acf3d3d794cf74614
SHA512451a72a905d2779728976b3fe5528f23b12b41a9f43f1b71afbed89d7b3e1d47977c85457aea2df89df74d7c5a7958b5eb9da4ebf364f97ca36aa26b2d904920
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB