Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
01-06-2024 11:15
General
-
Target
2024-06-01_819fbca4de80f7d4c58e7b60e7d0e4fc_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
819fbca4de80f7d4c58e7b60e7d0e4fc
-
SHA1
3bd6cf84de0a0c38ab98ffde17ad94f81508e0e2
-
SHA256
4328bc94b5d8f62eb0293efc1ab857275220b8b564cd7038f54a6251bd925147
-
SHA512
4802e39d247c9f34532d2575176067312e405d54fcd09769b2d4dac7552dc129172af46c6c70ac8c401d17bf218d5b8bab9523f4ffd02eb022b6289672857a0c
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 57 IoCs
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_819fbca4de80f7d4c58e7b60e7d0e4fc_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_819fbca4de80f7d4c58e7b60e7d0e4fc_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gdwqpgN.exeC:\Windows\System\gdwqpgN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmLEylZ.exeC:\Windows\System\qmLEylZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CulpRoX.exeC:\Windows\System\CulpRoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZUWHSS.exeC:\Windows\System\QZUWHSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rrqZtus.exeC:\Windows\System\rrqZtus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hilekFY.exeC:\Windows\System\hilekFY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RblfDVc.exeC:\Windows\System\RblfDVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xbLkiNZ.exeC:\Windows\System\xbLkiNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvQxwEK.exeC:\Windows\System\jvQxwEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJVcSyg.exeC:\Windows\System\SJVcSyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRCSwSp.exeC:\Windows\System\nRCSwSp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBiVbwx.exeC:\Windows\System\bBiVbwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TekStts.exeC:\Windows\System\TekStts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpwNqvd.exeC:\Windows\System\YpwNqvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OAUJTME.exeC:\Windows\System\OAUJTME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LcFjjlf.exeC:\Windows\System\LcFjjlf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZKfDjA.exeC:\Windows\System\qZKfDjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeeFdcK.exeC:\Windows\System\xeeFdcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJQxfBX.exeC:\Windows\System\KJQxfBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lmXjgip.exeC:\Windows\System\lmXjgip.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rcnvBuC.exeC:\Windows\System\rcnvBuC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51507cb440086891c82dd289e1072825a
SHA10f8ec2b3cd0f2c02920af175229eb79ed58b3197
SHA25631b681ef1a57dc70825172b38aa097912b6af50efb2d0f2b375afe180a1543f3
SHA5124c28ba0e2b23d25e977735d44348ee9f3d8022d83763641c59ef7beee49dd58227f711c905f889e82bda38ecc6a92dff5e821b743507ef8f4e393f54d12a2894
-
Filesize
5.9MB
MD5a8a16c96fc5fe98c53b42c38751fff0f
SHA1b253b583b25f431ccae605f5343d8bdba916e67c
SHA256096d7f006e93fa4135d688b80e209bfb17840b7356775a996f2433718e0580b3
SHA5126105a19853655aeae715338befe5a5e1c2fa80bd6a5af316091a537ad8adc489bf9fa17488f8a2eee416b6b5b9f623d534f05ab13121224b8b0cfe3f9151e542
-
Filesize
5.9MB
MD550bacb4dcd3ce3c401f92e0a08a2facc
SHA19f30d499a92a41d1275f38f1eae02913917b5023
SHA2565379ab893258d88dfbfa96fabe79a3fa31766395eca0b52475cee1f5c538e644
SHA512516c8623b31c976fe303753249e30d9e2ab0b41e0537c5472308ea158d59a0945b4d8c38ac76d7331f959e4acc258b7cfbf95f087acfa721d30fb31ab099e567
-
Filesize
5.9MB
MD5f88ee1966b7abdfdd355cf3b1103baf4
SHA17098673e540499f1295d0fb291885e657b881774
SHA256ef4f772a5d4e39cc3d1cf6309e8f1ac702bd150c11c7b6ceeab84d1668470223
SHA512f62c459fa7f9efbef4f719bfecf148b564de52aed90ef6e6f915ee4e3b48d3fed26c78fa3eb7262b0fa8aa8c2d40c1ce0e765b996e98bb83244b101efb1a6c92
-
Filesize
5.9MB
MD5ade61fe7f5cf9c366723389dfeed1658
SHA124e35097518400222df58ed967a38ecb07c42f40
SHA2563c915ae6e450793c767dbd13db1778280f86c063da61772c072a7b9a95bffe88
SHA5121d7ed4c46b05901b2e16cfa992b9260ed415e6ee5d0a66e51552d678d686a92d2488d3bf5a39a33ed059e8ab136a8f37970dd22964ead06e18db5a76917a8bae
-
Filesize
5.9MB
MD5abaaadeb577e7228e3f6d9d08ba6d67b
SHA191e56f89e117d443ff1cec984a9be28a1495eacc
SHA256f9deca587a0f8a2c7cf999334687ce88916be899161cf19dcd83cb9a8710b7e6
SHA51260ed82ffa8e643a3bc632ee2d20ab069a9fe76a588432d3a6fff2f8bcd5027b54c1b114b0301071ba458eb090c43dccf032fbac68826c2ad0ec44b63f3e37b04
-
Filesize
5.9MB
MD52aee9922cb20dbb8bf9dacc28ebac99d
SHA1a796341b2876cffe95b6bc9029f77dfb089f0543
SHA256f49a9984ad3c3c5e4f5efabe984a5b077c02a013cc0a9b1413694fc68f96e734
SHA5123efefa571160209f10b029ae029d4438891118deb190e132116c5a4c64dada5afa796a92237c9c84f9cec8277017d72c614b850f83de2037122cb32311b3da40
-
Filesize
5.9MB
MD56155add31e2340b06bec8b50c85a4972
SHA14a1762fbc632e5f8b6e65c1d84087a71a102c5fe
SHA256cd1b65d147cd07c6ef18300323f70904418a93401ca8a7c2b5fbbd8843d5828b
SHA5125e9b35f8595df42565ac7218237ee8ec90693d9d77a23ed8da9840920d200f9391b414e4f6fad37663172da60083780410c82e55237f604ebd61c890376e6846
-
Filesize
5.9MB
MD5e7ba8a5b47b01706bff5c0c8ee698c66
SHA1cb8b18824e76b4f8dd376e9e677d98b4bf9901dc
SHA25616cb9149db6e718d060b3c586c9701ae3c13af755a7bc770539be41132cbf0ae
SHA5123d49e981f50d7c3164792e7ec31119d5e8751243998fef0788fdc2f69da89a5f6de13913f45749a032cd12bbd15050aab875c64290e6ca60dde2c364d96f1038
-
Filesize
5.9MB
MD53fe60a864a3070ccebd44fba0cadfffe
SHA1d5335030664a41a653a5ead530d5f6fb618e4a8b
SHA256018d461c30224bf74475976d7dc27bcbbece166d3e66e6a11a8728a624de9d9b
SHA512691ef5e547df395651df9ca13976764edb12a25ec6be296616360712b1b9d18275fb8731dbdfbfccd4877477f1992bbe5a27090aad5aa469d2cc39ed040a603a
-
Filesize
5.9MB
MD5846489f1092fc18c26b69e4484755562
SHA1bc23159da14e385a186d1f07509cb95627e1efdf
SHA256226a5998f559d7ee607c9b6941447389ed5df919858a02fee6edbaedbfbcd224
SHA512e731039723baf7286243bd0ebcc73cadf1c68ffebd86c36eef4503ceb5f55a577e11047043a037fbc7a2c6f0622352a001b226d4b381662540aee150a5f9d593
-
Filesize
5.9MB
MD595cf2eab1180b7b7e8093b7cf8937191
SHA1c278a880c69a264291e6836d4839bdb9d3e0f70a
SHA2569363a33641b7684e139b9419a28df141f00819a1a393edcbc4fbb8111c72765a
SHA512cec6480a82b8b350c4d245555798caa9203be277614ff1f56c4f06a7034440d9001cdc81107f357265d14744dff27dbf8176ed420b4e20fae0390955c5124caa
-
Filesize
5.9MB
MD5fa8016ae588cd9b18c33e04f8f84e0d2
SHA10d6c7d4f9343907dc259325d02c75ec7b4cf9110
SHA2567d60badbed7387d9b1693758666fb0dc0cdc285b1cd3bb24cf7d3abf454ebfcd
SHA512fd9539085018dff6ad7823e3f2f87476cc6999420a34ec94a143045641b17e7e29085fc347c784a32d0a9b16bbfd3e8cb941adc00ff7d4129c109ce634a73040
-
Filesize
5.9MB
MD5336f4065171d218069b95cfd10f7b62e
SHA15ae3662ced1ebea644017f8c4ac7ee80e36b27d7
SHA2562acd9820745e9742e6ded9625bbe5c231c33d7082be3124ee1eb57f51eb5e4e8
SHA512ef393d2e1244b79bb61b6f45022b6d15c610a50dd8393290c96db38f0f9872adede5664a5ae79fadff16f5ec321a666ea6e1564405c47b5a561c81f861c4b993
-
Filesize
5.9MB
MD559ab2097497cd9fb65e193010aef402b
SHA1149d8546a0f047efdb5837eb21b76a8134ec272f
SHA2569bc564c3c80684147d91f1361d77f996425e2569c7dc820411e864b9e7106214
SHA512ac02aa1a2a215ad7ce979ceb08238c5a46f602062b57f86df6c598abf783e5c04b21d8e345cfa2575157841ed4d1dc31abe072c3dfa473256d1e15eb568d565c
-
Filesize
5.9MB
MD5215e42b083c4e448cecd11b3ca00daa7
SHA12a93bf35994c80233b83684d97527530038d2384
SHA256068288b620a738a3e65ec0677084ef87d9df231f68ab0ce1439b5bc8ca4edb4e
SHA51238d24587f1f0b8b47f8a60f8bc5926d16973c244b38ff565787f37a4e6fbe3f8ce59710992fc757d651de55e7c54801d1546566e375e0481f86422d413c253b0
-
Filesize
5.9MB
MD5ec9f12562dbdbc8bddcfa1877bb8426c
SHA1ae815a8b204213b92bdc9b2c515617c13a8805ce
SHA2566f4371ef2eb798d39b84efe5c6ec7180d3d8adb24a37a31b212f981e3559d078
SHA5124f26eae23f0f4bf365544c2d0383077751587b8eb72d8d47fe8c0712597cbd9e881fbc09f81701a8bbea89e00e0b5c6561d9df1459b317cfe3b21b89e8d44f70
-
Filesize
5.9MB
MD57b4736cbde479bf4568888e035e32625
SHA1db2b87d0820bef7b65a544d14a7c822fb9db393b
SHA256f2c64cdb9f4813941a05be6c0a7b97172babea0fce553c3ecddf12d4b3fc69fe
SHA512e7f1ff32c09a9e06a44652db563c9ec48f7613d8e2f322dae3478f0e3d5fc37142ed25a3e947054f0b575f74383d6edc8ead4e49203df4bd065ed4385b86faad
-
Filesize
5.9MB
MD5f71a3cce15b821cc5f2e847a6edcc56b
SHA1372b8ecda31b27e94fcab1e73657ef6d8c81f67e
SHA256b6c5a4b12d11104317b0d8df62f4af9aa61c2db02cad25c2912432da22e6e2d3
SHA5120e6a8a55c67b583cf4851b47673ccb0873dfadaf376970696ff678bdb1113e47360d271e51ed2050f87a6ea622866ea512009942d57492870ba0fcec1c47de9a
-
Filesize
5.9MB
MD5e5f30c4046e37fc3cf603ca9c9edb54d
SHA12692638f3e2cfddc7c3805261d1626f44042bd32
SHA2562b59227ab3e60c7c7f21bf8e48b412845cd47e4f826f81235212217644d56510
SHA5129e338f1129f12aff92832394aa67f1b530678d515d8538474d4afa7ccd52d471642592cc4c9711e07d0f20bc1570674540dfcc2a12c2a367d1dfb8fa9a6e8344
-
Filesize
5.9MB
MD561d67de1638d7ea411458f3498cadf13
SHA1def0d4b887887b5d1ee6c9031eae86dd3baf488e
SHA2568da47192788feca6f395f1ba157109b60cb0ce2d1a49459d4408946eeded1436
SHA51251bf0041f47c3d1bbdb0c9aa5a626abb29d4db9a6135ddabfa09e2ccdefe955dfe40acb0423d21cb7d1e08ccb31f9e4aaf2e55de07c16bc7cb7362019a4fc41f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB