Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
05/06/2024, 13:43
General
-
Target
2024-06-05_bd2501406eadb7d2df65bd23bb783b2f_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
bd2501406eadb7d2df65bd23bb783b2f
-
SHA1
f60652171dbf597722ab980557aa8a9c6883bc5e
-
SHA256
3148240785e61a6511717a76db1320fd4181865a0a5e4047aea73f430d33bd33
-
SHA512
62835e6b7273028d91411695d8b0894d5fb0fd741ad9b07433f283e5d74d684c96f45c3fdb5cb557f083eea90772fd778da8b411d8ed585c92e9f9c431c2166f
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 63 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_bd2501406eadb7d2df65bd23bb783b2f_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_bd2501406eadb7d2df65bd23bb783b2f_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iAMCHJR.exeC:\Windows\System\iAMCHJR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cvuIwYU.exeC:\Windows\System\cvuIwYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mnfmnFn.exeC:\Windows\System\mnfmnFn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhfubUm.exeC:\Windows\System\yhfubUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIwYrhs.exeC:\Windows\System\SIwYrhs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClsiwuQ.exeC:\Windows\System\ClsiwuQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvfUxoZ.exeC:\Windows\System\MvfUxoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wSLNZkC.exeC:\Windows\System\wSLNZkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WoECASI.exeC:\Windows\System\WoECASI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hLwzFDt.exeC:\Windows\System\hLwzFDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mNDRuky.exeC:\Windows\System\mNDRuky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcoXUVf.exeC:\Windows\System\kcoXUVf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQLEwRo.exeC:\Windows\System\IQLEwRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvKitwP.exeC:\Windows\System\XvKitwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsAItqw.exeC:\Windows\System\RsAItqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMccuqF.exeC:\Windows\System\uMccuqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJSzsMV.exeC:\Windows\System\iJSzsMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPRcJiW.exeC:\Windows\System\tPRcJiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvTxsFM.exeC:\Windows\System\YvTxsFM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PQSKlCZ.exeC:\Windows\System\PQSKlCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRexmJe.exeC:\Windows\System\BRexmJe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c8376409caa2f3ba7a9ee23e023bef7d
SHA11f64c8d65343a4d932455921080dd70f5dea1b91
SHA2568251be57d3435b18c346e8524f6a0529ae1f367b1e5be95fddc1d6690d0b2733
SHA51244c57ab9ce6a6ef5cfef0dde57b9343cbd3ff1f3fc60bc9c9e1b474b3406f4fd613d4a8b13ca190bcc972cacf0aaa990016ca2b44c032bd91ea64e81de933881
-
Filesize
5.9MB
MD5c84a384fa7a6528bc94985721aa8eebf
SHA19509c8a3d945eedd8b7f50ca756df14281fcffbd
SHA256d15db59575712cb2810b0b0897ce751d205d860ea4b616238289ea257f53101f
SHA512787ca90b4741f2c814e1fec484a10007066523286fa92a868f539818db3e62a6e325990bff18372ce049a9f6d010ef0841beb9d8d7a76238f07ae4e7e024c2e2
-
Filesize
5.9MB
MD51ec1eae26a6edc0339615a5a4fcb41dd
SHA158d0d232a03afe6a5245456b8dad12cdb1bca0f8
SHA2561ac1af35fed002ab44da5fe5f834abbb7c77a580127f7416ef971cb51a7b9987
SHA512f90f77e9b17bd040b8f34926414d125c7859b422405f39a50c655a065465df7eb91c6003442d8cc1a7be4dc41e6024bda3041e04f9b66973b59181af7f19c3e0
-
Filesize
5.9MB
MD5e3636d771a93e6135c41c94965fa3813
SHA12d68e2a4f703ea0687a644bb2328d0a3a04c6017
SHA25627e7701fc057d682a8b20da432e2d4dad00312dcd939eef340aad43ea097e014
SHA5128f23961e1980c94b8bcdc69093372a0df24648a44b71a909858e526db29c2014822aa29bc64c044b19882377ee9e808894a9cc87a33360c94f3e4c3e841b6101
-
Filesize
5.9MB
MD5c43749484f5f46cfdf1dcf10cb257ffb
SHA147510a9a2a9056cf7115076bbe0c0cba6d16dfe8
SHA2562742750985308f035e395e4513e40bcc0281a6e3337a0a9faf8050caf76063ac
SHA51222108512f1782166ca2c4807a75d13174a3b5f92987dc726959c6fba9ec55dbce91c640d0b263df41dbe8188e7f0e0260c007a1a03406ed59633279800681e9f
-
Filesize
5.9MB
MD502685000e9d785182d4eadf5d3d7962e
SHA1b255cef713fe58eb9a95a86ea68c82f0c9665005
SHA256a97f2ffd8bae669d20b58516a173a1ca66703a98f5d73bc7c5cf7521675da84f
SHA5121705d6b69b5f6a6abe132208fba14a84453142da13f8ee3946b70f24e6a333dee61115b582f276bd04622ad40c85d7c39c14e14e19ba1f2619c5e246eac81946
-
Filesize
5.9MB
MD5dd11c604ce9be93e7cb62874f87da3f4
SHA11f8cf2d1f92543921a279e677bc1586c82656631
SHA2561dd085ef42995209363a602c808de0cb93ced926b689cb2661c9daba37e2dbf5
SHA5123ffb4d2688db037dbde17b9c8178f4e4cebcaca73a2a99be6d44d16288a3a81400c819f3a142e038b33a0a41ceaf6cafa8d35376eca94190bb811b177faef3a5
-
Filesize
5.9MB
MD58762f130a01ac34309f26249f052f335
SHA165ee8f70f6e52b7775659e18f4cf7cbee58cbec4
SHA256af51c85e688af0cf9a05ba5265f3f0e38b9f9070e09b50e0dd831f4e6d41be82
SHA512b448d87a0e9eae89e24e7d9f53016d65f9e25a4765d2c13270d02e78e454448ba239912e716d761b727b3b0c79b3e4aa7b3477cbae32e253b008c252f50a9ee6
-
Filesize
5.9MB
MD51246c6abcd9d649ba8d1b3f1832321a1
SHA19d7ba0df6831d7a158943f462b26946bab0bea22
SHA25663fe1efb7811a77fedbbd132aee1ce42d90c7154c08a0e89c15633afe703bc5d
SHA51225a4af8e9f222d705c77fced471f2b98ba9dd344768942b4aac6c671ce6d48ccb81d061b6d49227d376b99f819da587ba22c19e9345f4f43dfdde9af4736fbf3
-
Filesize
5.9MB
MD55edbdc24ba174c281e31d3aee38f3274
SHA1d1ce416391bdd3b07e186009a18ded34b68c769d
SHA256cf3977288ab232f2013823998654b9413eeb54ad59fd0ba5bdf48ef1df19b80e
SHA5129f6b673cef7640d9aad40e1bf225ad96f7b134ad607c7a9bd850e94feabb54ae2f79bf7b718e06f8df43227066d9d228db7706cf3fe993e001b758d7035b3307
-
Filesize
5.9MB
MD5b62488860b120cb896b78f7d8fcc3092
SHA1d093d090a3d7b428a19ccbc087caf3759017adbb
SHA256b61ba83921aa8fbba14d421746b422eccda5e8e531348bc6526b636e5f839581
SHA512558b622cb6ce9a54d3d0f0d4bd433f62fca37a249d6884289e82945750cc7d7d100a9e88565806d86ccbaaae187b88b95154d32ba2aec79741d5b1f7aa126803
-
Filesize
5.9MB
MD5bd598772844bafb118f194e919017770
SHA18754d511432ca968f7446d9b5b2bcefd7571b0f0
SHA256915acc591a5433f71451a792079e1f39c6e509dbd5559a3ccb25dedd91ce02e2
SHA51237cd5f83dc019fda3fb27c0a42fa56c3038c0275acd3ca482470377603f7f77354737d49c59ef76d77686e2aff6ad2cbffc1cb91a9a8ab5a269caa7a0472c48f
-
Filesize
5.9MB
MD57aee416578af9fb3de68703ade5346da
SHA1ef37445ddb50359998164a6b94390ac3f7276908
SHA256f58197e3706a3d1948d98be881f5f2c4dc0677ea666933c947ae30cb3646ebd1
SHA512adbba8e9107d68083bd49911bfaef3ce777fb881edfd5828545e1876052985542ce8b3d6acc3674ae2ff27daa3e8d613422e0a66508286d2a4ec7b38be707c24
-
Filesize
5.9MB
MD5953ad39eb7f5d470a5575f117787e5c0
SHA1cf7a138dc5f405c4a4ba0505fcae6ee905c771c3
SHA256dd36cf84e7eddcbc15f7ed04558276e26ad6083481d746e95e1500e94c68fb7c
SHA5129bbf045270778deed7ad7d0ebc6723f95f0d8e8ba70cc485c6546109b6358bf4503bcc33c411f5cbd899d6bd1b36fcba85a4831bcdc66360122783b13df2af0b
-
Filesize
5.9MB
MD5272a5e32e8ba7fa360db48251939be52
SHA126b4b4080947b4bada38dd1edc26c8d3c7dcb326
SHA256646a3c07b05db4771fb20f7c60d1fbf0cc9a26b74755fa2ca4c1f8908b04e9e2
SHA512c8ec15f43c2c423a15939088c4ff1619d70e0d35a2d0804cc708a62c177ae50f73c18868e95c617dde3628937d63dfe32c8ba6f8ec7cde162421e8039d05eba7
-
Filesize
5.9MB
MD59ccbd80f7fcc9bcc05674d6ac32f0b72
SHA11a463ae33cd56540c4e5d755b3d5edaf31c9a61d
SHA256508152efb87fc6f0611ecdbcb89826e62188952c1679d46033f6aa06c444f42a
SHA512a32d4232fd45106c2f53c016cea06581111564d6674ade1aca30c67ff0b124831ca16eb056d2ad3737fc091f8ef8932de1a4ce08a6bddd7fe5218e311148041b
-
Filesize
5.9MB
MD56551371d46d3f6d14d626db67930ea47
SHA1949744b2bd7083d18ef6d90bb6655c125dcce5ac
SHA256bd9c7b00c88e0e5939c477578ea98a8e19c32bfa4e13032b52ec9fdfb07d05a3
SHA5125cf8c96f51b99e13983ef601cba3745e983b2bde584910a615154f061c8d429aa58f8c34d320a2a958cb7932e844ca30da59c346655bca5847df6cac064d043b
-
Filesize
5.9MB
MD514a2c8c9a862b273fd2727092bec94f9
SHA16a6c8ebc5139300610e0e1c895307b85e0aa9ccb
SHA256383d177bfb6c4bfb9b0fd7e9bd390a11b29c3cd8e76870646b7166bde0215776
SHA512b6ab59f60ebf2cfb23f44da388b883ea10cd788ca161354bff3a5bb4003fa220e5dd2cae6e12f7405511103fad78ca9b5c51b095ef071e94e37db819628208fd
-
Filesize
5.9MB
MD552682b964991acd60b008fbe70a68055
SHA110efba6710e000587cd4f4f7a8b4b09f6eca74d9
SHA2569e268e9d082ea6ebc29acb868ea8df240028fe12c8401b36e5c51be338acc455
SHA512e172f895972a8e2c56b9e620e2b78b8aa56f5faa238ec3b54e6e27cf6f3b0c9d729549db43e908e164f2f48554163d4de5485db65349e451d9bef600d4c78030
-
Filesize
5.9MB
MD5f51b02ef5e5c853d2207a4ff79b4512e
SHA14374ee0367c68afedeeb68e53d95b5511df36b51
SHA2569effb10e88fd95707be8707e0f40c9682a0f06f52c1de0b6ddae0c133065f9c8
SHA51287af53b612608d5782b19f20ae29734d3e841e5dcc84ea80ba9ba19e8eaf3ac52d46498dd75bd58bab48f7587b8f3a769104553128cc4a83f0cbf8934a3dcec1
-
Filesize
5.9MB
MD573a7695c0745670c6655ff28fc72cc84
SHA1acfae8f5d06f8ffd37dc197a3c51484f8a66570c
SHA256edb0b25a46666d6abf079835edb38de5cac64f2d06cb733d85a2db6e5243e2ac
SHA512230e47cd0e980f592cfc3f23e984c2d5c68315cfadac67b3dafbdd5fe771709b636814d7fafd9057d26f833b4bed2a2c76386dfb0942d4dd2f67753395373a73
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB