Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03/06/2024, 00:32
General
-
Target
2024-06-03_426b22a573fcc58a628a1099c6785775_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
426b22a573fcc58a628a1099c6785775
-
SHA1
7d7c0d8b4a1bafe67c52fb8e2dfb7db489f53d52
-
SHA256
50ae37b1eb10c084fcb62903ccf822fe4faa77e402d62e4c497fbea27e02e927
-
SHA512
b212abfb0b9a3c5a20a62aea0b99d3731a56a9e86b2f2b5416c8ab72240624ce801c43dc9e8fd664691100d0c15e61ed9bfd1d53f643fdfbed95b290143d1698
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 57 IoCs
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_426b22a573fcc58a628a1099c6785775_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_426b22a573fcc58a628a1099c6785775_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tIFWyiy.exeC:\Windows\System\tIFWyiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZNQtznt.exeC:\Windows\System\ZNQtznt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEnQcrR.exeC:\Windows\System\TEnQcrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VFjTbkh.exeC:\Windows\System\VFjTbkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jJMhJTw.exeC:\Windows\System\jJMhJTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJaZgRF.exeC:\Windows\System\yJaZgRF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QLqzGQY.exeC:\Windows\System\QLqzGQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPKWCZS.exeC:\Windows\System\lPKWCZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lbliTbU.exeC:\Windows\System\lbliTbU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRPGEPc.exeC:\Windows\System\fRPGEPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\syVxwRU.exeC:\Windows\System\syVxwRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebyqYKk.exeC:\Windows\System\ebyqYKk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FArvgsz.exeC:\Windows\System\FArvgsz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tZZIuyZ.exeC:\Windows\System\tZZIuyZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqASWNG.exeC:\Windows\System\ZqASWNG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sAGrHHi.exeC:\Windows\System\sAGrHHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CeLNwCV.exeC:\Windows\System\CeLNwCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUVIstB.exeC:\Windows\System\cUVIstB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lpttqjm.exeC:\Windows\System\lpttqjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmIDGcC.exeC:\Windows\System\OmIDGcC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rTFxyVj.exeC:\Windows\System\rTFxyVj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e3a97b3035632e5ded91275aa2641438
SHA1dbbefc90b52695b45b4385227ed6bf49a91747cd
SHA256c40e29c6bfa9001c4611874fa69dd6279b2a1752a4c3af0a4aed299f36bffab3
SHA512ae979eae3d4750eccb32947536a4dfc68da3f02a0fe1f3b7797244ebf626b86c3d2550b2467177ae7df9bfa496fdbceb5a10388464dae86406518887e742ab1f
-
Filesize
5.9MB
MD58dcb76324c028b247c00a8de45126287
SHA1cf840c4dd9adaafdab04a044ed9cfbbb5bbf5431
SHA25655156dc7ab6f1abeaa327f13a0fd54e2d5fc47020a258a1b0ce2deeba8cd75ee
SHA51221d9bc02ff646559f2b7a651e4d7603b9b11b1d611299ade2e288a581546dfff12d62ff358746faf178499adcf86e5c7aed5ff7e6c1a232b60aab7b9d732b7d1
-
Filesize
5.9MB
MD558390e29a266632c8acbad00b44c3e07
SHA15cade3babbbca12193d8eb253a6fb30da8ca931a
SHA2567c08b8edcb2f6b2176b67f736e3b927cc07dd98edbf21876268efa8c40f8a421
SHA512f156440594531feccde553094aecded0c01f2241b921c1dc205742e4786efb756999aceed429e2ac5620c9b142f16605520924a2659a6b2d372409341d77810d
-
Filesize
5.9MB
MD50cb490d5e3e79a5614fc3903215249a1
SHA1579f938fcdf95c41235316344264de1dd83d4740
SHA2566f54b8b1daa12de0c852751e91a25c76f558b9b034c3d901c461ce14db0f5339
SHA512defcf3be0a243eaedccf8f2b54edd41279c84635bb953afb978e26756da175c55aac696068410a8af3a78e55008bb83d9d975969c8e55af8bcbe396c5ae06d69
-
Filesize
5.9MB
MD5460cee5a2a4bd3aa7210598010d4b741
SHA1df758bf6c7ce613f73f44613811c77da3371a65a
SHA256cbc1e44875931c8e85dc46004c1c81f14e0711389ff9f9a666f8809277f8f7ca
SHA512570b3d922ca68aab26426256261fa8930fb547d805d0f3d5301eafd88c5e281d16d51d32c7664e03c7271de3360054d693ae979ad43063dfccea436c034eebfb
-
Filesize
5.9MB
MD561e0d6156b62c30cfd430ee012724a8b
SHA1532228a3dd336ebf226304aa4712dd8da724dc87
SHA256d5b90ed7985c1ddc37730dd6225533ef0eaf0436fc58a81b62aca664668ec2dd
SHA5123094ae5823eadc530f765327caa0713ce56c4ec76b53af012fdd2093702e0c3117fe0e3d08fd88142b5fa5b3734d7b9bf81b932deaa1966b26fbdc61e8f479d4
-
Filesize
5.9MB
MD52fe6d33d702d3ece58b8bb6d5ce17b1c
SHA18974b71425873265caa898e06381817d6f290e52
SHA256874d22dd9a195aaa38631428a7dbdc613ff3d7195c130877fba765b86f8e2b52
SHA5125ce65cf012ec8ddfe7594d6d8ca3a591468fb63e8361b2c557601015bfb6a945e8a2944ed761b510891b33e4e057f9af21c04e2e786b24a9c7a3df3b582e6eac
-
Filesize
5.9MB
MD5487c785cf7ae08c07b65667fe1251749
SHA1f6947f7ca30eb36becadc7070daa8b47909b3fa3
SHA2560894b23153296c18fad1683842a92489c8be52a07d66bed4526e53dc45889d0e
SHA512fd67a75435157644edd52e047d94d8782837ce1f12247884abd45f0ed5a8434d1db67c9aafaf821ede9048b95fc3227429508f532636f2b18c69bf58e09900d3
-
Filesize
5.9MB
MD595a8758f324fa90eee0aab1c2d8f5372
SHA14939f14fc1336d68df0ee2553c2bcbcae5e4f560
SHA2560b8ca98e517ecc0e0636daeed00c5edae82a202e54ae27627bee9e7256024da7
SHA51247702204f7e831135339920f90500aefb6c022843bcb637aee3d465f57641d84a24743f1cd73cf7a72ba20f6c50efefdf8e709ab327a541ae26aa6e7ddc61650
-
Filesize
2.8MB
MD57ca4c7d08ec840a69d3101c638d4b72f
SHA19a0bd3c709f755b63121fadc936f446aec1e7ee6
SHA256ad375c6a067690acfdb9ba070a3a7e26450ca7423af526c703ce192d7173f7e7
SHA51293ae69558c6397f1d10b68fc7e156b1c23dffe4348c43264d4d2484e88db3346ef1d13b6b607cc291558edc2cbc35a0667021d52c5cf7e17eeb41ed495e23c3b
-
Filesize
5.9MB
MD569184313dea90df71785f254c3daf879
SHA1bcf4c5e28da12db1396f4dabbeda61c362ee072c
SHA256711748dd84f1a1c2d57c93833d9db6b051008860feb30495beb7fd819e064a4a
SHA51243cae6651b7f89b3c5a1fe9084cf89a9165ca90da7bd5d9458144560fef71196b641d0af8bbe087ad646ec1cb640b5f38efc6bd7a73f25affe69cf85fd929500
-
Filesize
5.9MB
MD5e7261883d2b20216a2247baf33b75a23
SHA15a3bb157fcd793e2700dc8d816825df0d04c9d58
SHA25610372ee9624fe8a63762968daba639dfda3eb3b2a0996831994a4154d7c70b07
SHA512c0369feb0ef9c2b60c6c08c9ef3e0418cdcc2fc417956a066c2ae2025ca52de06915d2c6216c76779934e5b42043e0bac239b8cf1c7ab5cd25ea0ca749200a9e
-
Filesize
5.9MB
MD5fca5b4b5e55788277198eb2c5b84e6fb
SHA186328292a8d0488ac3873a4f9744a65fa450521f
SHA2567af57d976ffd2744121b7909af14e1d629352ada1bf893bf13e92cf07a01ced0
SHA512ec7cd0f154b53fd6e0aacec9fef5d29892b4207432bb8d2beb217215956712924dc546c7f153696bb049d02b814cd5f676a836f17cc7d476943743257bf43ac4
-
Filesize
5.9MB
MD54e56d943cf9e0bf3fb773694340c42fb
SHA1a4e5e23b65cbddc2d2bc876e6857be2011a430a0
SHA256aeea9c0e61126bea7355d3a0ce393ba9ea25da76ebf6e6a00409d6184dc91e8e
SHA51220702f2c95e3286b0d0c220bab0b0a55b71099d57f30c50e65276425cd81b3c0b68eb1d623f268ad01f04db0f2f181e60aae1e48e92188676edd9f6d49c64fa6
-
Filesize
5.9MB
MD5f3c93f2a3140e46ca7948bac1c38fa3c
SHA169b65a2cc9e1066f0321fbe04c84b8a6b4fe13f0
SHA2566a2155a843b263fa07690c9e75d5bc9e7e38eb97d9d20044dd4a937c0a8b9a29
SHA5123fc7ac9315e7d9bdfd92126cb5f8459d05ba5c551b724143cf263b74917112a86c1a89083192632fd2161eefc14b271ecdc89d56ed95243fa52a2d04fe05144c
-
Filesize
5.9MB
MD53d69c9e7ca88c1fb82a6634ba4fe7356
SHA18a89f121a017967b07f4f5992c72b45940357d5e
SHA25662a358d7c8ae29436444d61cbe47beb68c236a1082d87bf531ed7fcf28512bf9
SHA51239469e63f2dffeef4f97280c2198a99244827bdda47828e2458a91381faf7c0c70dce65b20d5f97cd11ccd201b6155ddee37339e8ff7767973114d532f5b9e8c
-
Filesize
5.9MB
MD5aa812c8fddf9980560f343637254b992
SHA104f990400a91d1cf4ee6a39dcc1f8d642c09650c
SHA2567ccc69e2ffb305ac6c09bd8bd26f2dd503c1198530c4527b923bf5fdf05e01e5
SHA51275a81d4445e27497f1a7e7b3aedc570aacf850184aba15c2e6fc43679e11bd908bad699e7bd73c0fd5412fff9100c1d2f84b82866b515dc78610fd974ef18b3b
-
Filesize
5.9MB
MD5b96b2d558021ac9609b363794ffff0ba
SHA19006d983531ab58cc620cdf7fadcdcb3c98a8b6a
SHA256d0d61b955a95630f71f85710d869f3c3685ab4b99f650ffbcdb8402fc33a15d6
SHA51235bdb45e471db88aa353cfc5625a1e978699e67730761058837704025cb96f99f6b5339811bcbd3e50603287f25bc98afcc0b839bc75cd5c6f1239a543b981e4
-
Filesize
5.9MB
MD5661ceddb24caa93a0a8a028966eee953
SHA1f388679698562d95170bcade28682c9a9ef5d4fa
SHA256e27db8d6b7e06c931103ed4c81e1b565a5d5bd112009897c8cf852b97d7048d5
SHA5122a02b13e9820d656e7e8c54538a36b18c21941d624176e9d5a1992f335fa8acf717c4bb355aa955af9dd7ef22a4f60a278dceb44b69dfbe11c8b75e5d197593c
-
Filesize
5.9MB
MD5c7ce75fca1b8d44e335d7b18b297f591
SHA18c62130eec5c4662fb0425ef560a9e4d9979882f
SHA2566b7ea014799edfb3df4b6626b529a357b9e82f1a12c1080435802ad6dcc27b23
SHA5122e7530165b982a804d49071fea883fee09a61e7f37d92dd5a4894af9fb98c8d798b301ce24a143e450d41ce961f3b75c83e2f44336b28f90ae548d96ef39344a
-
Filesize
5.9MB
MD5c2ea4d17672c49d1ce0fc67106d8f6b9
SHA1fce187ae2edf82fded6618ac25ed76cb69762b92
SHA2567b9a78d1839d71b23bb35d71d52eda6ff42097faee6643df002bc7d52313b752
SHA51240db938149027a3fac4610b8b8977c3ba1cf3f1b82b2057b4702b212060c49f310d7d9227283e4e7354fafd849781fd57c332ec4f9f44b67a5b949b8c9461a0e
-
Filesize
5.9MB
MD5d422970bc650d82a93417d441b0c47aa
SHA160c14bab7d4a4813d0d48bb3350fb05c6fe219d3
SHA2567bf38ac5ed8b7d4294c4124c5e22ced302aa34182335fb005ae4063da58c2bac
SHA5127bed080bd72ad96c44cc71fb1aa33bb7b8f46b2131ccdb8eaed10378a6a50c11377d0ec3fd3705da88b41e3a7ecaf3e29e20fb0688cdfd80796c3554b71ee23a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB