Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02/06/2024, 15:01
General
-
Target
2024-06-02_60bf0c1a92219729bb9232061c7e9445_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
60bf0c1a92219729bb9232061c7e9445
-
SHA1
4bf1388359e5cd539330a6ee421aee3e7a355c30
-
SHA256
9276146a0daaea319db5b7861006417b8bc1a86051ee8dedd9ae4016549de96d
-
SHA512
10c9d8947987061888f7d5f864bec9c9c3f78b1a053413943ce0075b396a02e41de760510c974e78429d74fee419d1808e158eb94c81e3ecc8c7a38f79c2324e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 63 IoCs
-
XMRig Miner payload 34 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_60bf0c1a92219729bb9232061c7e9445_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_60bf0c1a92219729bb9232061c7e9445_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PSaAFDf.exeC:\Windows\System\PSaAFDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbMaJsN.exeC:\Windows\System\AbMaJsN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CzUjYsG.exeC:\Windows\System\CzUjYsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GTzgVhQ.exeC:\Windows\System\GTzgVhQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cbLxWMD.exeC:\Windows\System\cbLxWMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EZXTYXJ.exeC:\Windows\System\EZXTYXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcjsRdb.exeC:\Windows\System\GcjsRdb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntfDOdr.exeC:\Windows\System\ntfDOdr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtaUoep.exeC:\Windows\System\NtaUoep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPxJipU.exeC:\Windows\System\iPxJipU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\duWKnHl.exeC:\Windows\System\duWKnHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdTfxYi.exeC:\Windows\System\OdTfxYi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\upGpHTK.exeC:\Windows\System\upGpHTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwcdjXR.exeC:\Windows\System\GwcdjXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNCAAAs.exeC:\Windows\System\nNCAAAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GIznIlS.exeC:\Windows\System\GIznIlS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WMETSRD.exeC:\Windows\System\WMETSRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaXnCqy.exeC:\Windows\System\NaXnCqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UQWkUkJ.exeC:\Windows\System\UQWkUkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBgUbzd.exeC:\Windows\System\dBgUbzd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sPNGiZM.exeC:\Windows\System\sPNGiZM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f1b0403fba4cf372514644bdb24acdca
SHA148052e312e55f4a8cb14e89da28ef3745d26e3dd
SHA256b045dcf3d458cea4a4347ed022b9f569fe4c8f583c3e483b85496057038b7ea9
SHA5129b9a61aaa198ac3898e2b9c096783028f19f0d96a9a9df257b116f0aad7badb17f64adc931036336d9fa1adfc4f6fe8e25ec1da6780b1ac5bd4bf674e04bc691
-
Filesize
5.2MB
MD5e8ca709c058dcfd51e93073395de25af
SHA137ff1ef625ffa2a2439a52dc910f06ff84749662
SHA256ba5ed17bf560493de7f306f90e1d057521b254bda7918bfeb7d4d1cc77aaa30c
SHA512c6369ef6c4769d2c9a77c5c06e90314952b54d14b2e25fbd5f9f93ddda36727f85b80df4ac995ec0ecfcefcfd9ed06b579c55007fec506314bd19575a9b03e42
-
Filesize
5.2MB
MD5eadf5d9a003bc1efef289c2c9ab2c0f4
SHA1391187cea1781e5b65033fae1e1793e507dd0219
SHA256ce88c51a81bd8bbfde22372bddad46b2dee9efd0d81ab32e903b82f0197fdd8c
SHA5127464113c577856a5a9e1f01930699d260ed1e522fc0f02c1669f0c473f60da307fd65b9fc61ecf0f91ed6f734f7045ad3a43e765ae6b022baf7546d3b83037f5
-
Filesize
5.2MB
MD58f17a61f1e015b0ae3c03d28fdbcc8ef
SHA1291b977547f8481579b9fbc5bf5858b2e8b1add8
SHA2569913abef6a30d29dd76423f211765000495c9c5c59166586908c0c936027eb11
SHA512beadb600ec3e28c2fce8add1bc8d7b5e089352000b9e154e3e04f132751eced1f9cd1e59e93c9b100bee010dd45cf6fc91b33a3d930ed2491086f4fb25806224
-
Filesize
5.2MB
MD53d9b706b80f9b5a3693c1f652fa41cea
SHA1473ad98b7070b6132fcdd70c768b5502e1d97b9d
SHA256ac5de9a7c915e0922a5bf4085e4dbdb4a8c125cc17a54f730131792eb0aa17c6
SHA5125e621c3ca658726a985dd3e211e79840b03fc79377b07b778016c997932f49bb187c4c864bf68acf6e03ce3b065dfd992d93d321fa0f80fd54cf6f5660195fb0
-
Filesize
5.2MB
MD51ab64ed850b59ae06b8ab4b026cce06b
SHA1acbc7bbafaa87f364d73a1d3aa8ed477dcf0bcd6
SHA25617d072d9c58d80ec290dde65b746ee93579d4d17b898b688aa86a0e3de709110
SHA5128368893966aef6d866a3ae26269c5437b1b6ea9972271ddbc51df0f1cd554c47d0f32d783bfc84390c62a489cbe759e19adb1a5756c612f9c73ff4ed19e73556
-
Filesize
5.2MB
MD559157dbca2122b77a797d36ebe4e3c78
SHA1516cea84cd29b2a0bcf70686dcc3fa4f274df386
SHA25601daae427d7270c0a26809bbcd7af9d846f731ca84cc94c576ca5fd92f09f894
SHA51220250a22a1c50629b682a37333476c177026f2c1a6ccd66633f6a1f09e8831cfdd74bcfb6b19dd28d463c27939239a6bddbea307aed4fb85f7cf68c15618b292
-
Filesize
5.2MB
MD54c1b45880e28a5da75d9884396fee805
SHA1a84eb4dd86255b0cd822e03ec4480136685ea873
SHA256b6035f5a9744753c132a2ae0ad1fd594f7be14bce4386ae138a0cafdf465ec55
SHA512aa42f397ed033f9b4691306b745ccb60c5c7bc1b432bedec7b1a2693455f534b776b8df91d51f39b983178115637acb50f54b7bc8d477012010f3742c3568f70
-
Filesize
5.2MB
MD57749049039c3657f93fa122211a59f7e
SHA178ac832f3c7d552af44ea6a9f0739a4343d2e98a
SHA256ab07487b26a1943f28d677767d6c3854991158aaa7889d2a398fb7e62af16218
SHA5122a3669e49c402dd430cdb329740b0f96497462fe70e0280d05b3809bf97ddf14a00c61ea339885526893ca9e948dd990ad17ec78117702b7c553f0405a5bf4b1
-
Filesize
5.2MB
MD593800c722eed9a6671e36a5b7cf7d046
SHA183eb108a43f591d8d8b76eb75f64f6c1a1613fa5
SHA256fdd98513fbf07dc291d006331c19963698ac7c87af08634d466beb09af281f1e
SHA512c99e850835fb6860198df3d5699ebb7bc1fe30045b9972e2def1b6776f6c16c25f0d069513e147705048807dbf50d7c5b147e55caa589d4bbf13f5d1bf34ebff
-
Filesize
5.2MB
MD5f2a049c9483a7af10091e6087f803b25
SHA16d770364c86f693ae55e741d995b27a7bce6e50b
SHA256d5434d7673dbcbb287c0e1e3f0dbb1622aa1028284df58ec2f471864ab8b1d97
SHA512abd5f78259c1b28eb1ac7350de065b1c8e0c1e4f66c9434f075716853ca18be89dd35d6e6de50a1d102b56eb5cbe6fa0ad3eada1f10117337fd3ed63a9390455
-
Filesize
5.2MB
MD554f0f8a4851e6066b4a2bcc4b644e5fe
SHA12e6d93b2458d9203c4c4120a0cacabd4bf310a6f
SHA256b76858367937f6204e61e40f64ed5168f6f98999d3fdde20af28756f40ed98e1
SHA512d8f28922074ac296c17fa7ce0b9d98790d6ef6eeac1c35ceb01181d0936ff63f82638effea46688ebc8b1861d6618b01a0251faee443de93099ed58164c1daaf
-
Filesize
5.2MB
MD5f7f029b555b03c596fb1296c9e2ac57b
SHA14859923587e007c4525bcd696196dab3ed58096b
SHA2568223aaa8eaaf95bd43936c3a3f07ab97997832c8a69f54083a17fea3ac8204db
SHA512a082a3b046d03a507c04b6f3788ae2362a445a5243a3d44c6317447188385f348f4d87d7972c24798e84a444f7b9288e31d6e47569f66578e1c4a6f60c10b899
-
Filesize
5.2MB
MD5dac5764699b6f258a41dfe4b1000ee50
SHA1fb77830fad05dd66f971775c9ccf2e998723cd2e
SHA2567360ff8613c97a5a02ded6c0e1c3a5fbad971d2938e0bfa55a18eb76b07cd545
SHA51244c7a2b5a6139b5848b2fb1712f083108dc8349630d15107e201f22b65c047a448419b8ec9fe447e5e177ee72b21d5c5e62f1fe94c1084d2d0bd7e4975f72e33
-
Filesize
5.2MB
MD5422949ba22c8f8fb9e80ad81db06e48e
SHA16e9710a0500827a9cef1cfb0ed5109140a818481
SHA2563e63d7ba7b8bf5e010326d0fe4faaa1dcea417993aa4b782d6b27cc3acf8988c
SHA5124f11ba01b1edb3dd1f182e2498982979707336418b7219f0db11bf483ad5908dde56c87caec82c3c80fb33df83e53a3a8b3c4d0d71674b395a19e03c7d16ca10
-
Filesize
5.2MB
MD551a9e6cb0660dbe2109a20eff1bef0eb
SHA11e41c96736a4c74ce9f7a313431e0097093763cb
SHA25690fd9e55f50edb76f0a811506fc9fd239f116d2ab2e318e231af43bc9026b236
SHA512470464d48e6a9d23e8b9ec30fd1943ac3ab876a126cdb7c1fa73095d6ebe225c4c9aaff1445ee5037b1bbee7b16ebf721287c2670b646dc035d210ce513c18d6
-
Filesize
5.2MB
MD5baaf1804d010919bb5841df3c00d3942
SHA1d8c59ca1173d7354aebb6554778cf8d6f787014d
SHA2561e3cc9566f611d081d27ad20f7839c1492965bb7a214580b5ce66a9e3fe921e8
SHA512e03562b95c69c0597895fadacd018ac56becba44424f0c9af0960ae8670dfdfeb1f0be0b2b4ce906c0b3d3f0d9f8d1b498440298e414e873e3c23ce59d2a3a37
-
Filesize
5.2MB
MD5bd454601aa75ae4d4294ed83f7b1b13a
SHA1d6a2d432c6feb763440d527805219841c7d6e080
SHA256b7614ede596bfc9fe31b7e98182e5f97fd93dad9f4f5605ffcea9cd55d9b547a
SHA512aace620171bfff2b6d43e790f4e8b059f87f38e5ebde129e4070538a430db2264e2a6526e8afa35d2b5cc39d03cf4a402736ea2400a64adedcc930fedccf945e
-
Filesize
5.2MB
MD50fbff03a445a7e50d1beb690bcf2d84c
SHA133499b5a841bc3d8cfdf2bc919af252b49c9cbca
SHA256639ffa5edb88fb790ee4f561c3b351093cacdb78ce65ad7ca29bcfe6b4888adb
SHA5128e7c0364d7c6b353e9da1e2d0fce33eb0c1f5740fa6d8b3c4cf15fde215e3bf7881d347189befe8c5f8681f14634fc3cf8b44a6fc58d06ba29b903554667732c
-
Filesize
5.2MB
MD50daf646a3ed02b7a1633056e9052bbc5
SHA1ed6ab92db160ab3892015bc6d39e7b695c2c0b6b
SHA2565feff20f8c7098f77cdadad0dce42a0b9a0e5e52b92aedcd3eb6846e3cee0880
SHA512203df71009de9906178038c662871416e10f8f89223d50fd690d05d591ddf79dd4933f94fe7dc83b0d918c08ee0494ed2bdb751187b632eae0fd91e21e521eb0
-
Filesize
5.2MB
MD58770a1ac20387d5f353ace97e2f0fcbb
SHA194f3d8ec5be5622a9dc5afaea54a3809716ab175
SHA25605b0ed6bafa82ed4ac7e7cee67e6d471c2fb1cc7da296a104ac6a8d11ec21312
SHA512de2bcc4be84ebde4889d660cb3926935ad75c12d52374ce226601942f3148c56d1c40102eb86de0ba6b4433a01391011e14de6c2a7188a5b2bcea448436f169c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB