Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05/06/2024, 19:00
General
-
Target
2024-06-05_4d1bdec09a8a0e958c35440e431477af_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
4d1bdec09a8a0e958c35440e431477af
-
SHA1
14a403d2ddc38de45daccc4436227a80f81f6f65
-
SHA256
8f899723822603bde6c11d8651a4aa86ee02271642de842871e50a7b5302a3de
-
SHA512
02d464ec0699b24fdabe84686a4ea5ea60143fd8b5f510b0f5dc195c8da2e1985018f3d18d68d165580369d4fe7cdbf846c2844d857afce1db32dbaf3eeaddd9
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_4d1bdec09a8a0e958c35440e431477af_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_4d1bdec09a8a0e958c35440e431477af_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mxtOiBP.exeC:\Windows\System\mxtOiBP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yDdRgpZ.exeC:\Windows\System\yDdRgpZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wuGGdDJ.exeC:\Windows\System\wuGGdDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjrLxki.exeC:\Windows\System\jjrLxki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dhekLgM.exeC:\Windows\System\dhekLgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GGUUZpM.exeC:\Windows\System\GGUUZpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IqkpJsH.exeC:\Windows\System\IqkpJsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvzMdTP.exeC:\Windows\System\qvzMdTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DyGbTNL.exeC:\Windows\System\DyGbTNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgXOhes.exeC:\Windows\System\JgXOhes.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCvbcth.exeC:\Windows\System\rCvbcth.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNeCpqQ.exeC:\Windows\System\eNeCpqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQAzqCF.exeC:\Windows\System\aQAzqCF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVDaCeB.exeC:\Windows\System\hVDaCeB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FlhOZDg.exeC:\Windows\System\FlhOZDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLAAbUY.exeC:\Windows\System\iLAAbUY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNZpgPB.exeC:\Windows\System\NNZpgPB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sweehhM.exeC:\Windows\System\sweehhM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQKgBTQ.exeC:\Windows\System\IQKgBTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npQlcsA.exeC:\Windows\System\npQlcsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lRrHIRn.exeC:\Windows\System\lRrHIRn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5dbfe12372ec2f03d8ec6d7a96b9283c1
SHA16ddbd10ffd296f8d1551d824653f5b4e62525cdd
SHA25653ef67ae037bd5ba9e8bbf87dace29ffbbde828dc26d3ca2358ee857a3224336
SHA512146f9e26162c43504bcc2fe51354ad4aa2f4987ea4224be087464a15ea18e827ae28e9d770b65b719b68468863b79699900b3943008d662d8c3e59cb24af5b38
-
Filesize
5.9MB
MD55f328d855a17fb1f5b505c4d5c885890
SHA1ae92e54e434bb4d3550ae5dfd10b17d2f8de70e5
SHA2561ca1f1a496961b6dca6c673888631573c2541c1893bdbe79981bd275b61816c2
SHA512e4a2e59be1941808a21b297a5c51efed73557dec61c32f3a2cb6cdec256bf0781cb5939a53cf56ddb561f685f85d3c2ff3f6cc27a88da36f6c814c08b7ef1d9a
-
Filesize
5.9MB
MD55694a935db4ba6ba96f3cc60d8c607bf
SHA1556bf249108f314927e420503b2174902120370b
SHA2567ebfa4057b655ceaad0fbe6d3f50c454661387505296e90328eb39ecce6cb303
SHA5124be3c174aa6c2d2a547e7d73cac4b197ea5bf1c461d98c0263ce608091f60787f66f9e0720845dc343b5fca1d978637a457f49d6976793d622a372254f97136c
-
Filesize
5.9MB
MD51f345673fb2a33e3b02d2cf6cd884e0e
SHA1f2c3582d58e66028fe1e013e7552488e44f1e5fa
SHA256df0731375f245e7f9e03f978847c5bc7317ebf6cd56f728a618ea65f2b9f86cc
SHA51279df576b63df255456b973d85a054de7564ae0d08f23e45a5054c49aacd100f24146717607cf16bc92cf71f7b618fd9a6123dd3a24bb027b2b90abd2176aa296
-
Filesize
5.9MB
MD5ddc57f6072d7119520ada84ba3adcf51
SHA18c069b7ba5f046dd4913eee25a8422d5bbd2ba39
SHA256470162f359d8d2b5c3a03a3c0808e8e52272ce56b04146ae037f493403fe7093
SHA5121719bf5f5f4b74e385a5679453fbcf2bad671ad56010c2aad2eae031e091e6c6f7abfd5999232a0a7d2ce49e5094a200eba4ae46197b5ff9e57c308c09c3643e
-
Filesize
5.9MB
MD5288a35f6b007e43e54f51dbbfcf5a80c
SHA17d653491663d33b3d99878ed8e22628031304f8e
SHA256f1d7f7bbcfbc6a6da0d2a1cf15982f716347a5e9bd2014807b551d742fbecccd
SHA5123d0f878415757f9654e9593cfbb6ce60aa9c1abc9d6b3ff52808fc92d7657337c60ccb64da7b760125545a5c34d4b05c4dc7062258a0fd115ace04268b5cce00
-
Filesize
5.9MB
MD50af3bfa48aa52fff0f609b5d9e1de592
SHA12dcb9b017db650584947f8f97af0f18250be06d9
SHA2569b0f82f30393d16d627f6ec9082d3688056e8848fbe229f93c91aac4e137c3e1
SHA5129f6ef590b3b6976ab27e95590028aab92b402d4a49163f215822e313664e14228bedf0efa613b4b7e688e25a3ef020072faddf0b369d871796c3831434e2150c
-
Filesize
5.9MB
MD582561c640a133f9629af9b99458b8b84
SHA1289af2ab1f0132029e3e22bdcc0da586a9f1f280
SHA2566e5d7766dd2ce7e4e7533767e2b8062f4fccdbd90ebac554840be5a09c0815ff
SHA512d9d08371ef6aa086c5d19d0ae902fc2230547d6051ef27d058782cd4b520c1c520b2f00c50df6939c96689c811d60ef748826a1898e7fef22e37ce1d0e4e95d8
-
Filesize
5.9MB
MD585418406789ca614e7cb33553d4f4a71
SHA1ca84068bf41c12f38f85e3964defacfc7b81536c
SHA256d125680c1fcc20b7a389f0935456db90e77cb47ccaacf0335d1bfcf9678e909d
SHA51236e5bf1018f679ecb92e2e9e6b35ce178c24793eafe86953cbd2cd13e769ce774d8bdc5f8b6f97e8b7d25035d9348c1606455d2afb07cdb479b6ee95d73467d7
-
Filesize
5.9MB
MD565ca6cda968eef6ba12062792b450da6
SHA1528a855cb767fecc1608fc7ce119de9fd8eb84e1
SHA2564e41f5d4e59396a5474170c5443f1df120fd35ce22116bd0df7e7629bd3242ae
SHA512856f5053935ca0c266a1350a1c73fcc3a6841c3fb1d6e2a8a55ef8b50c399569331883299124bb6ce34873a18ab575f84aabf1c68198ba9b8a9bc2028dff8b38
-
Filesize
5.9MB
MD5563d8bb0052d5ac4fec6a2f0bd037c7c
SHA15e398082b946c20e539d86cc4250e3b32fb87fb6
SHA256e7f9efefd652017859d81674ffbfa17560cf04a60e6ade215868bbbe755c2c6b
SHA512efca994eb0c4db6eb71f1ef5ec59f99b68c4174c77d964e227b285d2d08ae75fd02a13ee7e7d622eb8792e1d0e55bf81720ad332eeb2e7b83e9cc4e6eb05627d
-
Filesize
5.9MB
MD590ddfa77bbaf1922ec9914719a91c3d0
SHA1624625e8243cf5c33410831457f11e4510415016
SHA2568d077a63c9408f89b03c174651c17f622bbac1b2096ff3a7aa6ed58937cfb1ff
SHA5123cf2bfad832f83b4ae49a05a2f10a67f20690240d1c86680c9ceed88caeea880c8eff05fe2ae47586e14434e7508e05b569b7c78bacef3c74add9c9b80619fad
-
Filesize
5.9MB
MD5359eb2b48d4a82edaa6080fd2be55a1a
SHA1945071cedf9c42cc2061697f33919bdfd42bace6
SHA2569c419008798aff7dff05bf5abda9cc0beefd504dd99357fe95aea4f166a225c7
SHA512483664bd9b4f1c49e524cf2e4db522e199c44f9d919be09365f81b4afb04f9a8d4f29a7a0b93a4572f3e6621a15174916428a363747869a12c65beaf520447aa
-
Filesize
5.9MB
MD5b67e8fc35e16703138b7a078a5c4f1b2
SHA1994ef3a14f546a898bf8c0e37f38638b553e8aee
SHA256984dafaaf8642a859d7cb7039f8ba5461cb1722fa6c7724753b7ae97fb3db896
SHA5126561b9580e0bb26853ba8950d38804eeb11ab609c0d2d9edfb918bf32b41cc7b6abfdbe28c79af8fe501cdd4a1397f6ea119769d9b594513143624ae1a2d5d07
-
Filesize
5.9MB
MD58d583ec70b820b7796d69a3e4b513050
SHA1ffe832943d97612f16617141ddfea24b496118ad
SHA256c13815b074d5c2e5b3d1461303638e010efee25f4a2301f85ca5e8c5c5ecff7c
SHA5126bb943ec989860c5dc7b839e3cb213976e7cd19d6c567b63f43e25b1c659c4e4a0174bfea526e657224d4f6ee248478a1069438b5ff77775499200f7b3297111
-
Filesize
5.9MB
MD5afd5eb129752c3245256180e846a53fe
SHA111112eb88905159c86d4bae0a692d4006f56afbc
SHA256d365c23b6d38ed8f40f2f87f7b13306f435981e02800d67ce0065f6ae5c482a9
SHA51251d7996ef8fe6f639736f84d20d40c33921de17ba77eee21ec47b8a6ade49aebb9c8b4c08cb4efe6f8d9794fcfd5253911de5bd6fca77879de99560c358b1d15
-
Filesize
5.9MB
MD5ba9529611b6fd61560a5883e745e0012
SHA143e6dcad8760abf29d572a34f8ec40d8c1de6711
SHA256cf7f569c981a9f1f9b3b0984ca2ec73120c70e1cfd3c234bb4bddea559a75f24
SHA512ac4d5274de4e99b4b2cad014db17dd5bacad19e05d6c56b579b3503b74749e0eb5b9089dc5583936395e3b875732e25f3e8af2aa633b0f85943614545192fdea
-
Filesize
5.9MB
MD5e3a01e0a007c47775af3b90fb5942dda
SHA1c4b09bd8704340087c47848cc74f3d086f2f9760
SHA256fb1e30d2d4e418d2b1c820fa50dcc2f4780d535b92245179b5decfd1ce0da236
SHA512fea0e9e155003f907f23f741cad57db982e72b47e569bba8de1dfe128ec45729e5598863aebb397fc0fa2bc5e93eae7a0959b06131ace651ddcc88af0df6e93f
-
Filesize
5.9MB
MD5b7e0701648264658e1a0237390da56c1
SHA1310a8bd5e1530c4ee7c886cd452b5242fb14e177
SHA256a93dd0632211d732d4fed3e371fbca71a22e5351868fb2ab87fb3aa2971f3e1a
SHA5125412b95b752d466b2e4b3d45eb74220fad69fbc7b6dbd55df9eb2eb4f0973f05a1afee0cdcc7917c3a0cd67f4ade25272719975a32ad19922c420fd8d126ebb1
-
Filesize
5.9MB
MD54d67193612bcf7ece097514330ee0d87
SHA1dcadf46fe573341197ee87d0ec726a53dd443340
SHA256d7672fd4225cba400f1f1b9f64c867a3aea85f90307ffcf959ae5c36a156b527
SHA512e09a35f4a9ec81ffb40fe4da56b51471c063d8513025d66e61e25416042a1b3f33d223b796afa510b508ea093c4cbfec1d9612ba7711272bd67215bdaded86d9
-
Filesize
5.9MB
MD5a3825f53ae43770348a6c5f2abe11a6c
SHA120fb6dd3d7be8782acaaabe37c6493185d302000
SHA2562041bc03f65a66976ab7e735925ddcc9849131edfe3b26d4bf645ade0397dd6d
SHA5127eb4b83be97325b0282bc65c1330362b221a560dfe6956b0c7e9adbbca4dcd3deb621f8f9e2da7659dab64d236ba1402ca7c12063ca2815b52823965e4778303
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB