Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
05/06/2024, 02:53
General
-
Target
2024-06-05_eed2129441315e3ed01649605566e6a8_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
eed2129441315e3ed01649605566e6a8
-
SHA1
c141bfb026e3de54aaf7e66ae4a95e7d1b70248b
-
SHA256
00bdc6a8775359e6cf3ddcd7f5cf77c1bc540c5dd21cb009feacd2b835c298d1
-
SHA512
37bb98059e3fb870212fe418343057dd9e89e9a6545c3b63ebc8455a16415c110583cdd1b1b0ccc4773db7fd81d2bb0f653d850d5db6d7ce530a1621661f96eb
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 56 IoCs
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_eed2129441315e3ed01649605566e6a8_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_eed2129441315e3ed01649605566e6a8_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CyJCeFZ.exeC:\Windows\System\CyJCeFZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vaNETbn.exeC:\Windows\System\vaNETbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WmGxPYZ.exeC:\Windows\System\WmGxPYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNraFLu.exeC:\Windows\System\tNraFLu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BseypWg.exeC:\Windows\System\BseypWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oZhcPsm.exeC:\Windows\System\oZhcPsm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CBPuaDz.exeC:\Windows\System\CBPuaDz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrYohFL.exeC:\Windows\System\UrYohFL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRCNxZJ.exeC:\Windows\System\vRCNxZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLEeByR.exeC:\Windows\System\zLEeByR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrbRaoX.exeC:\Windows\System\XrbRaoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SahLDOV.exeC:\Windows\System\SahLDOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nsnwgGK.exeC:\Windows\System\nsnwgGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRLRnPd.exeC:\Windows\System\CRLRnPd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsWSseB.exeC:\Windows\System\gsWSseB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VacEGgR.exeC:\Windows\System\VacEGgR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OHXzMHz.exeC:\Windows\System\OHXzMHz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iWRleyb.exeC:\Windows\System\iWRleyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yrEkKrm.exeC:\Windows\System\yrEkKrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gneqvDu.exeC:\Windows\System\gneqvDu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UICCxbK.exeC:\Windows\System\UICCxbK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD50dfbd8b12c383a050782b2b22e007165
SHA1620d8245f39ee9fdc194d0b6bdc94642c1f4b8f6
SHA256dc286e4682430529808274a7262e7b1e585d12b6e02ddea3583b7a76cbfdb15b
SHA512ca76f90beaf240f100139a84209422e2c14b4aab94fd88fda5ad84b05a33cfedf9feee0885241c03af0e1992d21d99031713eed55f9af956217d3b861efeeac9
-
Filesize
5.9MB
MD5d9adf015250da89c51d02813c7450947
SHA1d81dea0e85e822366b1f37adce355d0e06362887
SHA25685e84b5563d0e78e0a6aa0c3512f279d20b94f226874ca55e323fe4ac63efef2
SHA512696cc5f43ba1ae650239b5baf0b3afc1d182431ff3e3ce0463c51b074cfc49ff44715570406290fab7ba4faf43af8be7088622a5bc71076c72632cea1ec4deea
-
Filesize
5.9MB
MD54a4872f0e23b410bd28b06615c9c5888
SHA12a898dc6a8ea30551335b7debbf9385fa1faa005
SHA256b2bf0f9a79de7737f79553ded90ee9807156cc175bdfdd2466290abb21f0ba6e
SHA5129f632026ede30e91d6f4815e2d623f120e00bd43c4b1f3edfad19b765424b39db816d3f7d31c8dbe7149017ff6064640715d79e3baf120fe2a09ccc678346596
-
Filesize
5.9MB
MD57e6d13265e171673c248edcc6c3e247c
SHA1a2f754bc10d388d0c9f0e0ba9d679cfc701275d2
SHA256d007d46e52d04256db142840f7ce1f2ceb055496ed2e8d5af8c81dd657b765f5
SHA51247d403fd50aad94c4cf35a281fced8a54483b4fcf8e9c44de1c49cbb0dc3265610f0daea20ba224401a8e211f72d9b24e5abead102b35bb12c13bf3352cc8051
-
Filesize
5.9MB
MD5cd784562d52ca29fb008f22ec7c51bfa
SHA194feeb1cf980179aa45cd03943cbcbf8c850723e
SHA2566ff3fbabf6ed7cc8d802a014a3cbea5e6938ad11e2226d9bf2d2fb717b22689c
SHA5121103713e4528031783facf1f9d13aeaac46430ce9ecb5746adf1ff052e2972c3dfc14c90e474fede2cd0166b7d23ba83fba56122022c213463d1398b4c765dd6
-
Filesize
5.9MB
MD5ca4cd0bf44e0a08e9b63a1a26ecd7eeb
SHA167db3d2564ed072308abf2a7c7fe157137715341
SHA2563c861292b6cba1f4b761ffb5669bcb6dca707f18899035cd6dde2447d520fac6
SHA51238d239ad3d94ca572ad000ecf28d8ee82c5c7622222ae44572c17c13a59ed24969730c15747782728285025824c935a3583a124a1d4a4cdfb29b6c22e4d2ab6e
-
Filesize
5.9MB
MD510d3e91295328ed1d17f4827488b1293
SHA1eb3f19b19946686d48e74d88ccd2bea7bf158c45
SHA25673058ef298ae19daf263881de059898e9eef19535d725d390b80066ab177a2c9
SHA5125df105c440c3d725bd9c922246b095fcd6ee4356d91a57edc3e1a6d40fc8a172e4a37d1b4e7e5d582f321656ee8d328a10501380b2ed17b05572fdc16ae83495
-
Filesize
5.9MB
MD57bcf931d96f9b019fef7bc2b973db554
SHA136c6429c2893bbcb2d2a04a8d3a479978556e62c
SHA25620848228519b1a366443a11d7d2fc82e8957b6775a00f27cc3d4e1f4e35210ce
SHA5126c018b15fb42dbeb470259391ade6d234c7637a410480a55421860d9b9c2a252bd3c8665b977b58dd1a19ac3a7feb57033b51eff0e9be22499a79bd5cde8212a
-
Filesize
5.9MB
MD538b5a58382ad54941063575383edc5b8
SHA163288c5e9768f551c707486484a2f9f1d6ac686f
SHA2564c68dfe7d8f5de36fdee9194a938c62ba56324647f31ff1bfdb6910ea3e7909f
SHA512b78f0c811e43ec6048e975611ee7cf5f22bc80c51c66bc18067bc319e4c5ce8e01094077fd8492f9fc9b7c2bf610f66d3458b77d605471f21cb42d090a0892d8
-
Filesize
5.9MB
MD5d66d9f4bc80e820c8458d2fa92e2d682
SHA12fbba3b9ce6a9b0f100652bc5254fe59251f7ca2
SHA256475f0a2584e31e36ba8709b2ea1155f20347481c36881f7b74cbc8c6884e04cc
SHA512e20e9f39e736808f01c8edf7c3d93b86fb9fb0367703aac21a050b15c92c957ce97b21fa714ad0f3deb6df7d1674bc810ec1fca90d99d5fcc7868a8e32fc34b2
-
Filesize
5.9MB
MD552a06593adc70fed4be39d67e34adefa
SHA1c7d043a348426c6d961b3524484e70868303511a
SHA2569e5c3aff9b5bed46b38e7d1d7d25f330ba69cddf3e463102173f60806b9494c7
SHA512c4258257edda9eb2acc2528596c9d51c31ddde85a8cdc670ca79412ba07f0a04c87fb0c84cde1fb19b1f6c53afd67920fe78ec6eb44e6910007d293ed734218c
-
Filesize
5.9MB
MD5a613f6db627fa5a785285f8bc3d01474
SHA16f824a513f0e116c274d25eb984645b894c6accc
SHA2565c1e69e218dc9fd59e7a158469c1e31861368b04bc27f4aab50c9a7d477e0b82
SHA5121ec6df567d1a0c970505c1d06d7d56e301db24c1013655e70d9db9e1fed16a34fdc4c28466ebe007e9c11587b6a64426a5d14b3a8e4690a3e7ab43e510861edf
-
Filesize
5.9MB
MD56c53b0abf96b9981dff23b9e93f39bdb
SHA1442e01e0ece2ebc57632978b0191a5be81246a9e
SHA256c680f81cbdeb0a161ba6c8eee03f0ef4cb0609c3612c7f612719e60e637d7ad7
SHA5124c5db9bff509a271067f70e5d17b10d4ecdc94f21f17e3483d9e5d47e94896677ce1bc8db3cfc3223b8482de3fdcda209e8fa117e13112e1d72a03ee6e858ff0
-
Filesize
5.9MB
MD5f2f2fcca4b9dc70698809443a24ac3df
SHA112de40988ba6b7402a18ae47e1fa53e4a312edf9
SHA256c5d740e3b3dd6d9e755b2c52551e95b59ce035269cabf582cd6b090872d79145
SHA512933549939f130fc6bf9516cb4c1ad1dd271d0bb50018b28a99abb01a7f9666a0021d814ca34acee034b7d7d776ca9395f2d4c81fed87cf722e4b3e842a0b0cb8
-
Filesize
5.9MB
MD5a075440fc3eb2700137099d488a18aaf
SHA1a6f9f3e2952f96a259e5a29ad3b4ec5234461deb
SHA256c65e5c88b1246f5aff0caa789a917f67a45b728503f84a5040af1d766ede4acd
SHA512a4844cf03fd0f7d1cbd75235c9de1009212fa825c3c7c2b6481dfaa906b1f460c7bf347d1a575dd7b7c87834443585f01fc663338c26e67fb9a2eb475178a3e8
-
Filesize
5.9MB
MD58ae3b8a9b44240619827d34186fbaf5d
SHA1c4293b5b3c7cf52d07dd8a290b7d6d5024f64cd0
SHA256a05758cd5429207eb3cd177c0dcb5083a548abcd7e22a56abd16222688848c68
SHA51226eae3836fb1e3e7e1fe5a69c1df4dbb459fc2918da37210ad020fde9b94364343c46ad62544dc5ed0d47dfc0ff50e481c4cc9c30e1c73e49da4a62154b23cda
-
Filesize
5.9MB
MD538adcccfdd6cd276431f0c493ac0e6b3
SHA117e37176ae19c77273eca55dd9855350fb7a6787
SHA2565b5f3f3bc3d932ebcf394604dcc4e5b00b1013c2dc535ee46700be58cc2bcfb1
SHA512f2245ff0618a1f021e988d69ccb0b2d6cabadf281d8545e744d28c28c035a88566b83e723789c29ce5b81d2ed786e026869d3b27dd68e8e3eaf37c32ef44e804
-
Filesize
5.9MB
MD5bb78cfe8f418d515dd8b0c20d5d7facc
SHA1bcf560be686f98b6ba96370959c0f136981c67bb
SHA256f684a107d3d56c7a57569a26ba752a5ca10de69c5ed67402cb8873aa093fb8a9
SHA51231e28175aa1589d27da5adef8be023112ca814ba3bc568a0246b36cad9f2454a3c7d9a51109dd7b944cf558865fe34055fd12fe7c2f30fd7af6f03202f97fb0a
-
Filesize
5.9MB
MD50303f3d39f8a4b004dd6e346305c3512
SHA10befda7288d4e04d4d3c1ad22fb5fdf8f1a21e80
SHA2563971c86f132dc7fdc930fa439edfebfe63c28e560e51c5fd34efdd204916ba4e
SHA5120d83a0e5f934df1b0562b928cc0b01b0bb655f6d478ba2454ed2e133e50c3a1823b0f379526b45b2aedb9b4b25c65040a0b25eaf6eb70fa003aef64d1ee61389
-
Filesize
5.9MB
MD51ee6f9c388a23ec2396cbaa3c50efd8c
SHA19df94e7e80eebdcb3d256cac3fb8c5a81503f803
SHA256f480256a7b5d1c6291a2ebb663f67173d3695ca4e903cb444c907b37a4ca6459
SHA5121a489868793bdc48d61b3caf821e5a6886733d88cdc933cb9c1711fbe6513ac3a2523f030bddcd3e396f709d45e4ec56c8d91d8a8e9d444d2fda68f33aef6d0b
-
Filesize
5.9MB
MD55fb1e3f4e2e8598f361524aed20b4eae
SHA17cf61ff8c4d8cb56295c5f02e1a846e04985ddb5
SHA2569a89dd8c0c650622ce22fc93a3e92cb31bf43c46134348ffba488a96877f70af
SHA512e9fbff429d38b0c0e8c5fe7a50bce700c9c6e29997905723520e206e8dedee8608057a05032b35940f511bc2535fc744e9958455cae646596179858323928c42
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB