Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
01-06-2024 08:28
General
-
Target
2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
b1ad8f3ab7a101dbeea8736cb7eafb6c
-
SHA1
28893da12138d6ccb76894530f91c23d155ad896
-
SHA256
ec6a7e7199b886763c8cd0e06570dfd130b8a80087d2d76ed9590b3209f2b1ec
-
SHA512
e82f9f64d8794ffb93bb6758f3cbc0ebbfecb638c32e9a5e223fac2c6d253502f5aeb6c14ef117cacbbe492b1ca1cb03a732c0669a4ffd9e32b3761f322d956e
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 52 IoCs
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KNOxXVc.exeC:\Windows\System\KNOxXVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wavHHHM.exeC:\Windows\System\wavHHHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DSTgAEz.exeC:\Windows\System\DSTgAEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfrBUgn.exeC:\Windows\System\wfrBUgn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRlnBGQ.exeC:\Windows\System\eRlnBGQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EHCWPQv.exeC:\Windows\System\EHCWPQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQnBNyW.exeC:\Windows\System\cQnBNyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pjZtzXI.exeC:\Windows\System\pjZtzXI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KvNAnrg.exeC:\Windows\System\KvNAnrg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpXsRDF.exeC:\Windows\System\bpXsRDF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNVtzjX.exeC:\Windows\System\wNVtzjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uyYdzjF.exeC:\Windows\System\uyYdzjF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMdaUlN.exeC:\Windows\System\AMdaUlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhPYTBR.exeC:\Windows\System\rhPYTBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAmYZie.exeC:\Windows\System\kAmYZie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQNqVmZ.exeC:\Windows\System\KQNqVmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CEcfktf.exeC:\Windows\System\CEcfktf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VPKrpnB.exeC:\Windows\System\VPKrpnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkcaEmb.exeC:\Windows\System\nkcaEmb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcNIFdT.exeC:\Windows\System\PcNIFdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfGazVB.exeC:\Windows\System\kfGazVB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51ad8e10142ff40f0fd73898145311c53
SHA1d251e094dbed2b0a977b7dd2632b21c1d1ff8365
SHA2563faa365a0c37d37b5295895a7886133ba22256ada28896a55b06e56f0ad89306
SHA512ce3b24c8d03b0c26cb83ffe57f40fff6dca69e04817ece1d0d193a0002b574e9de7ca383f690b6e27ab8a046571b9ea06e4a9a90272266eae7fd276aef1c0a7e
-
Filesize
5.9MB
MD56ec038fc70abb270d00a143d3de95f4f
SHA1e8fccb10b74c7ae75d5707c1adbe41d4ca4168f0
SHA256317e40ff5ed589dcdb4145e43235d5763332a23054ce3accfe7e476880959244
SHA512cce6de9abdb243bda64c4eb10a93cfe95f7ef176d92187abbb7f415645cb8cd317918a77fcddb01c9d9be47dac213844f1fb528abdf83d7196eca751111f53b0
-
Filesize
5.9MB
MD5241efc2e23d684a64b1311467ddfdbb0
SHA14565b93507cb42cbf866305b321c0a107a41f66f
SHA2569b197a2990d2398d76511b1e17a673e0902b8ae823b149b2b897fa9cf1d346cb
SHA512a02d71f8868a712981ae3b7c15a6142a906da2c0581938f2f69af57da6251a5860a862d5c7199bbf0731c5bc0690d3e5b0dc65c2cd4e2e3087ea3fcab1fcf083
-
Filesize
5.9MB
MD51ad808b538db96e5f262eaae6aae6301
SHA1785b2c381a0ca9abfd75f7579ced743e797ead05
SHA256d8b9429b3ab1531a7477e7c7068bf339bdfcbcf10a26973cc31671e93c77b0da
SHA5126360aa91c077cfe14ce25279e7e84f1e6bb8f198d7640a97ec2c595057cfd918de2ec6526b74ca024cc9677d564356d5776c8a7ef3058283e782b808d6a3b965
-
Filesize
5.9MB
MD5a83dfc730cabef31239edf431370ab4d
SHA170eb21935490a227cbc6c0352bb396061b547691
SHA2563e8802c9550f068f75a23fe50bbf776271d922e33318973da555a100d8ed6990
SHA512287040085e8e3002df649875205a08315d028835ba003c416d1b5a60fd5eb02a5fab317521bd334f607694348ce6d8725c7e6150233187ab96ba45ab24916501
-
Filesize
5.9MB
MD5daf98f875f1fdeb526cf917149e68fc1
SHA16736c1a3ae58f7e089376d416b2a472561578157
SHA256acd564756bbb12d69bdad4cbc8d261741e978bd291505a2aa3ea171287de7247
SHA512cc043da7158f0df2de184003dbec5584decd22725e66bfaea7e72141e625a16f269c42c4a65499ae212ec16f27cbc4ae8a29b773275a2a0aab75100299bf54f7
-
Filesize
5.9MB
MD5ee2e60536866916c974110550b349702
SHA134a0411e47e3c1df458a98aa6f315a1433f7bba4
SHA256680949a97d92c5e19b1a29986b841327c8f6748b503027d33fee4624d5e4966a
SHA5123d864082941826e31dead80e4d048ee72b179c6d71a200e34c788ffbab925c303ed57ff594ac7cfbb7f310c994b53e5b6c69d71a8628d461db49f40a7cd58616
-
Filesize
5.9MB
MD5203a95c9349c2ebe9d6c08e9399b650f
SHA105d17ad3b1ca8a61954c94df83e01e467d7dc952
SHA25609212c28326e05150eba6ef4dedf66ed0d04b6e41ea44a3a2f53d490ebb2b0ea
SHA51257d32291b0ca393fff1bd0a4981969567a4286aa0421d71d289fd56f44822eb5cfa0db2188e98a9e111a46841c014177c0f64a0e8668f08af352b27f71882ae8
-
Filesize
5.9MB
MD56b37e7dac374a18b39cb38884b1d9e76
SHA1d0f484706cf0512ea7799d11048b3511742e8b67
SHA256e8a93179d614c01301ca0ec095e5a14351e1453a801a1cc39294dc7660c76201
SHA51207cd0c72e43909bf9702869521afccf4c8009edd8bfae8d1ad6a59dd27508027e1dd8a5826df24944015298098041203cc6f2d71a53c0b08886c3ef2edb561c3
-
Filesize
5.9MB
MD5fe89e8b0b3086dabf067d89f2e10ca95
SHA1670c8a8eb0f98616cc0dff2204181813ddeb90a6
SHA25623fb6512d337fd2724dc8858d79d3bb49fd9e6a18effa3159d59741bd500e0e2
SHA51207ad58d5dc928192f764bcad45fea7edcf7e971f557e60ace95be1cc0aa8dadcf2da4f1f07c80c17db5a690ab01d9b1ea2c1f2fa81d59893e617466a4ef182fd
-
Filesize
5.9MB
MD5fdc283f9a117e0ee1a4a2fb0f1112d54
SHA18596a40f9e192af8cd90c116b7ab1e54448502f3
SHA256928c3aeed1d42f96d8fbc5c3276692a814c153036bdc7c2b959c2afebbb8d3df
SHA51232dfaf55f786cad245aef1fbf41df79d56aeef276a579cc3e1da51f8a78a86580d0cd8d0edccd358bd8e177c39eff639d4efa08c2bf24fa27dff179ccc6e20d0
-
Filesize
5.9MB
MD55bfec3d0e9c90088d1de928124b5bd54
SHA1e65cfe32a1cecb6258358ce0dbf8b287bcf702fb
SHA256240ea7df9c45798b038f870db237b84b1ec9243a1fbd5e202bcb64a37dfb1ce9
SHA512d48e28509bb62dd45751ceeda623aa22bc100d6aa0bdf6bd54378d8202890fb914a4b44b9599dc0cc1d6f9abbbd6f2e8b4b5e0d03a8d1871d6123f66f7e0d406
-
Filesize
5.9MB
MD5d430772508d09afb830336ac99099fb5
SHA1fa135ee94ccab63dbbec8555f623a6d615a81681
SHA25626d4bf6ce1a411655adc72e70c84d9183b2af8e1c28edd3d0d87484e4f4a7a96
SHA51277745c5fa6aaeb15856a40ec64d4aa1942ebd1293b5e62350982b9fcafca069f383d352d9660d2878bb2120752927307f5aa22d432865ae8d44c4883d5fd5c21
-
Filesize
5.9MB
MD5289bb31f4d344f46c65e7018a70fe15b
SHA1ac28b2304e59746106a197387e1b1ed3b6a3cbff
SHA25628b30efb663fbf01a94f94e1c68764e20a694db8d06fc36423eef5f98be8bff2
SHA512a1fddab388ad87481c3682630aa0c55a35d54939c534d12946959fc93c1ada0bae144f18679cc43c4dd6be2e4cbbe5f14f713183d1f9e7cceb4b1e3e80333f1b
-
Filesize
5.9MB
MD5129e94a8e6834e141c4875cb19f51144
SHA199fbb0f2f0bf353b1a6314c6ddc612d6305f1e61
SHA256b4167895fcc91c0830523867de64568c8dae90319d193a384cde8fd4c7855d99
SHA512c56daad34b1ecbf03c20dd64bd689e20f642fc15900a0a9a1dda5301f26176ec4d8e4f47b24938fded2b89184a057757ab1d43ae9405a98e28ced0204dd4ddd6
-
Filesize
5.9MB
MD5ca5ca002627886362458a30d68f41a8e
SHA16baca9efc8d9a228e6e785084bd92c269043570b
SHA25666aefbb619b05cda3663a382597a658f7c43ec18b748bbb04a982f924946a293
SHA512d83fe78dabb74431f059b6d4c6da972610e6a5fc5d87348a0a05d9431cac935c9196f30dd4c7c0ac7da7c5293f011635027d9a771b4cc0ddae42d7d6f30bb51a
-
Filesize
5.9MB
MD506226d09ab3b4f26502c1dd199eb1ea3
SHA17a46ee8ed3cac1c94d48f978dafe74d4adb154a0
SHA256daf0f741a9b66b3a560e57801e8447907a0821f2d1e3d77a10cae82915f8f0fb
SHA512f0e117d285af6af2cd879b51e36113a452486ab3d0d66956a4bad40f9890854c62dfd1068784161acc9d3458fa31d6c7e4a36ae441054019dee0b840dfb2972a
-
Filesize
5.9MB
MD5656e1b2919cc3dccec56b420eaac7161
SHA1c84e6ea7da8b024843952f81b5699fb218b7e9e5
SHA256d5123a7daaf51370372fde48f21d1e6490530950be4d3991a764396351054441
SHA5124babbf60f6d00128a29f7b052484a0b1aafc73d596e54a99c05ae08943f20becea2663110f44b5e919c6259cbdb7a85140be8efb098aebc4886e38931e695636
-
Filesize
5.9MB
MD55b1645d42dd83888a2476a0e323d381c
SHA1f9270c50bf552fd38d23ea541aed7100e5ff5f41
SHA256d47db7b7c11c693e97a72d5f0f89332b198e4dce2ae79bd34f06e6a2e1296812
SHA5127a2ada38fe4c8ba9c56458b17b7388f76aaa651ee7699627c011f269e4fefef19d8614572360a4d889ce3e543e873b44a398703ea7c4cb5639994f7fdbab20be
-
Filesize
5.9MB
MD52e1f88b930bc7d8f71911c1c6616a0a2
SHA1feff66ab8952986a161ebe3823b46926a9b35815
SHA256e3a26d731eedebfea459ad3dc29fae01bc9e29f90b36189baa56243f0ffe31b5
SHA512494e362c2c963a4bde79b577b9298034489f2d8b4945f136ecc76ee9135c205510c131b580607330defcec7bdc0192140b7a0dcd3451d3408ae915dc01695619
-
Filesize
5.9MB
MD50724f8e609711d383dcebf3b3a30beab
SHA14335e23684b2dacd41b3289b5522ac0e266bd0d4
SHA256f5c004e7ad69f0e6853f0e6cb7c70d19a65683c1a244fd915dab4901d969e178
SHA51280063a3f236594bda309f9079c5d0f80c682a16fe40ade41d6b5a5fa3db7aa2f00ef3db0c2dd4300cf91e529310ce663381d66cc961f38db2cbe676b97704649
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB