Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02-06-2024 05:04
General
-
Target
2024-06-02_daffa1533f837a6e5c37a98b47a5974f_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
daffa1533f837a6e5c37a98b47a5974f
-
SHA1
1aae2efc43651512732ceb057791661edc1be8cc
-
SHA256
bcde48fcbdf19046a898e961612fbabd77ac5b693ebadc4b3baf653b36fcd7ab
-
SHA512
94a056eed732b216c8281b633809f649b59d822755c5fd207a4885eee1f6c6c8ebbb8b030c07a7404e13af24fe0dcfd6d8fc52ac1ff7dd85811d4683e41427a5
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:T+856utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 51 IoCs
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_daffa1533f837a6e5c37a98b47a5974f_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_daffa1533f837a6e5c37a98b47a5974f_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lTJFrxR.exeC:\Windows\System\lTJFrxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WaTbhTV.exeC:\Windows\System\WaTbhTV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RpmkRlH.exeC:\Windows\System\RpmkRlH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMaGjMk.exeC:\Windows\System\SMaGjMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzhJBPZ.exeC:\Windows\System\FzhJBPZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JVKRqQY.exeC:\Windows\System\JVKRqQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGmCsMl.exeC:\Windows\System\zGmCsMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIOYrba.exeC:\Windows\System\ZIOYrba.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUKuGua.exeC:\Windows\System\PUKuGua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jGzeYvT.exeC:\Windows\System\jGzeYvT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCdzqwl.exeC:\Windows\System\yCdzqwl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QDDVhVh.exeC:\Windows\System\QDDVhVh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOcZLjp.exeC:\Windows\System\uOcZLjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebSyWCk.exeC:\Windows\System\ebSyWCk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dUgzKMM.exeC:\Windows\System\dUgzKMM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\awUpzqz.exeC:\Windows\System\awUpzqz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Yodnbnu.exeC:\Windows\System\Yodnbnu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUypbMm.exeC:\Windows\System\hUypbMm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKRkUaE.exeC:\Windows\System\nKRkUaE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iqyEQXg.exeC:\Windows\System\iqyEQXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zgZfrFj.exeC:\Windows\System\zgZfrFj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5a7f41253bcbc83aec06472db391867cd
SHA1b9863e899b4b33325e7a04f2d94362b11283f3d9
SHA256fef60f10e787da0f15e812a058ea53475f144f599a37a4feedd5a9a28cc33fbe
SHA512e78776c388b61bc1fd10d1959b06ceed843d17c5df3a2ddd4f08345139dde0ec402dd34deeeff7adcfd8575bf65fe50fe6ad11af19ba06fd140b55eec2fb01f9
-
Filesize
5.9MB
MD5967850be0c4f6c6c1bb852491df3380c
SHA1e394ef78d017bf8871fea0dd9149a6178ea0d606
SHA2568b9f9fa922db4766274607f4f71ba9183bcb41df2def060f74448e80af3ba413
SHA51256d1da1f14d8dc97aa64564187da88d87438051c67ecc4351daab5600bd2e70e7e948181fdfe00baf33f25a2d185d7c489a534360a4cb4c764e2a897487868ed
-
Filesize
5.9MB
MD59b38956d1699c502109251fae570fb86
SHA132ff285ea42166568824a37dc225baa169edc55c
SHA25673a73e06d1b6b3e002d5f7a3b6b7a9a28bf7387dc18122f19244a576f283bc55
SHA5122e0b5299113aa1268e2e2bbd74ca9182a9d6c0cfcca095d4b246665db333e64061f1714db264f4855506abfae2386dc55b09784d4d49eaeffc2fb04230e8d6e7
-
Filesize
5.9MB
MD5c3b7465ad8a30ae10e157f18947b7b30
SHA1f9be27f684edb7e9698c1214af6906b5a6353661
SHA25661751a0f200ee5fa3e8714b2155e152c10b5e68a56073a676e97b4ac297f115e
SHA51226c1f5fbaaec8dd5bdf463682feaa2e701f79f25c49803f5ae20afee337a64497e1ddccda04746ed4486330464de2b2cdc6433fce1f3b55356f8aab9ed7a8490
-
Filesize
5.9MB
MD5781f8e9485b63cbcace2cf4d7f94099c
SHA1135cfd2dcec4bdbbe281430ccbf18bd94f97fff1
SHA2565c9878a425dafce17f3f8f350fb1b65455f1d3c01e23c099eb36af5df8b9b81c
SHA51270d8d79508ab6beaba8ac5aca1084511fb8797c477764548d5848652f59e7de5341036ab5504f957763be81cfe6ab0e7195b97e355f564032ea9fb2ba6425c9b
-
Filesize
5.9MB
MD561fbdd7aeaa73136e71e8fabf5924fa9
SHA1b2842b8b899335c0ea3b5e1f01375f1daa565039
SHA2563d36a4a6ac38d12c32c5f8d9f3847254d49a668efc40378b139b6ec5604d6f64
SHA512d7ffc81440d9f6566e5e12b9267cdc37f3bc6e5f41c35e3d94ab227ef18b0517b6993977919401eeafc7570d98b910976c18004aed3784015d03b14f4d2e7352
-
Filesize
5.9MB
MD57cee6f8c607c2b012bd0ab2d2af90eea
SHA1206d052e89c29f329dcd4b5d0d92e530327b6bc9
SHA2569a59668a1a159a026577008bd61c2a8329b8286ab50f04e413c5ad3893ba8259
SHA5123674e38a2067aae7e9d683cf3e4e9ed18ad7f93922f984763d33bd0a4a4265d83e399a408ae7a4ead0a9e81cecfc5b76d3401fcb33cb01ffdb95fe25ec109228
-
Filesize
5.9MB
MD5e240807e9925457a0e308b7e79fb7970
SHA1627256a90274f05117131a632035738da8e706fd
SHA256fc1bf63cf7a9f46f5cf8595c81b949f07b9928fdca897d0eb18c5592413454b3
SHA51288a69066566578a69e38d5cf23c6808bc5e3b1a577d748c4c187dc7b599301e8763c8e156237333a14b027ca0ffaf3517dec73b85b0a143775fe586557c0e879
-
Filesize
5.9MB
MD5f7a0cda69c6aee2a32f64ce1e5086e15
SHA17735be9c5d18dde065a84545c1596d0f6325e0b8
SHA256a04329d83ea633b364f9e17905c5059121392d597eb6cea3f337082640f495d7
SHA512c2986c0c463ad3063536f95c121e445958d1efc8210aca645160b33ee6dd34372ddccb667130e5be22c01419894e6c868d10ff6d303ac9751a21a0fd324abc97
-
Filesize
5.9MB
MD54f1f8a36aff04ae77f0d442e4610cd1d
SHA18ec6070fa2313f123c0a3396792ba91b90744797
SHA2568ef46dc1267bf2afdc753dbe1f16b1afec6686f69e2d859a32c58d390dd07315
SHA5129bb996f8b98c7f5c3a33944fd50409d41c1914369ee7b35380dd173bd1c7da120f76fccbc60a29d0127bad037702fe807cf68a350da8b6531fe7b1583608b75c
-
Filesize
5.9MB
MD58f551ba4c07e8d7e25c416fa422f08ad
SHA1f8c1f87e936e0af53d31704f91f26889621c9373
SHA256579011a715b43377fee2142fab43bf7500893c507f90e76808dca71ea7c4e9d0
SHA5128941bda9caa6dacf3bdd89f822545d5790a12cd74f71487f84795c83e58c07e9ea03ee02f3d544f796b17380232cc7f1c3ab8b8d6acd623b0905cc8dafc59dbe
-
Filesize
5.9MB
MD56128a8952411e2084eebf67ebfd515a8
SHA168fa46f47001ca723540929d022ecaa4b6f512a7
SHA2563e8e50d3f96761dfdd9c10a0874d305a1ef7eb80322bbc06039fac072c161a73
SHA512e90d2ac6fd51c771047929da873985f112c38120b8792d5a43959146d64dc4b7dcb897b771b2ac1c80747eeec18e83501fb9d1ff364543f0eb65da0bceb45b18
-
Filesize
5.9MB
MD514e6d693fd66fbec1132e3ebc4dc5492
SHA1f6708279d4ecc50aa7d02b6da1a6f832527100db
SHA25602f7a0a4766fa187538825a6580b458e31727a7e782325071bd054bb9dff2bfd
SHA5120fd3058be7608f367b964bd6c29d6a5523f93a4598c0e603255ce654807dfec55e45e55fcf45a702d2b5fb71cc2114b6f25870a640d1b11f4615e4dd47d9a973
-
Filesize
5.9MB
MD5c7eaf3a8aa775b5fefe02f327c6491db
SHA132a7f7e7c4cd8a34481a9546da515846d3be9769
SHA256945ab8b424639b1177f1a10ead03a215c05cce40e9e6dff8e1fd68bf4cff9cae
SHA5124d3853ea2470968db8bbd44541de708ecb303feb0ec52296ca69fab77dde93fffc94049e4323aa3be1655964a27907197826b5443119c3c897fa2c2fa344f100
-
Filesize
5.9MB
MD519bd0722ae42300a6ce0a7a78e9d1b1c
SHA1ec97373088baab726a3c68887e9fcc3f9a87a206
SHA2569afc85bffb2ebb4f7095c3c1da7b4ab6313a0b1eb9c56aab2791a9d435dac43b
SHA5125a72017f6720339284a9f4a2e3baa74ec1ca24fac4db4e6c38bdd5d9185e9b0c4a7ac363a970ad3abe9a40712aedc7322ffc27ff90489087c9c807d5b086cf92
-
Filesize
5.9MB
MD5d6ef00920b5a17824f818c97ee2d7592
SHA107488be2c58934f791a1522b8568e37cc3457c8b
SHA256af4bee64c09e2c5373f6ff4571eb31d848c6447c135a518dd40955a330230bd0
SHA512cb370c0539da0c000f6d00c5a707b10d6b2b66ce366b736b9c8f18aff018804d1b0272cceea30f8f911dba4e1ed0d8fa265a3e964609340b1ee30640dcbdb409
-
Filesize
5.9MB
MD5d8d7c9d942ec94fafe4821a54c1c9192
SHA1ef1261baa70b0eb818f9fae076c7d9126e2a9e1d
SHA256ad9ecaa4c16e3e32ab701d224590f492329ece9dda1d81de40dc358a8d9f0e8f
SHA51217771fee311353b8ad5511c22bbf9a6b6abaa3ab01be1b776557f689be326cdabbbbe71588015f749b29e03633170446d28095177081c8d49a3ad6898f22bfa3
-
Filesize
5.9MB
MD5152e29ae4beef004c335ee5c9cfe72ff
SHA1b4ec6aa225fbdc1825659edf563b115911424a9a
SHA2561b2a5dd22268d7209b1919d97077ac89d4d0cb7e4918caa95373e37f872ecee9
SHA5128ef7d5aa946da536d76f63858705313b5bfad6fab4b12d1a96a0f99d339ae5c36a1968baf97ce7c4a2c3ee62b2c1c86a932ed5c02b684e3f72d626ff5056dcaa
-
Filesize
5.9MB
MD592f6e201596ce0e002658f5dda0ed0db
SHA15cdc171d991e6beb269f1ad6ebc7785c2404e330
SHA256ce44bc6e6f419a32e67ebe225762a13571ca9a5e1b3053d9544dcd0d6c8daf9b
SHA512359d591402e1cc3b9e586bea06e4316e4e5e5cd53ae44fb9c420bd7fd8ba6efa9a23ecfbc93b5dd8ce26fd24004aaf5e3f6345be49fc5c4452a33097e45e5259
-
Filesize
5.9MB
MD5d629c98dbf191622312952f72a50e158
SHA1c54fa5e3c0f671783621e43e969b0fba6b29afe2
SHA256e52fb0a0c2d0a0b1ad55103f8b88d0d06b444381fea68d7eb640b2cefb25b4a6
SHA512501e48d28db85372cff2527674b95c3a4db6c07d983719f38154cdb39fafa65d38c6cebae62b7dc011df3885ba6899e94b4d9be238af39dfe5525ccfd26f9891
-
Filesize
5.9MB
MD56ceedf8d05242a16f3f371af58e540ca
SHA15db1851adce0a02347cd8a9579bd431bbb792c41
SHA256eca6cbee928b62cd7c77bcae5f3afbf182cfcb75a171f499e093f7eb60b31f1e
SHA512ddb92a7bd730d65a6bffe2c91743f2d09ce60261b32d8bb6413242a80b6822a480d08bd991e197ae8fd267ea2eb81caea6c1da94b4c299b87f131a31a75551ac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB