Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06-06-2024 01:00
General
-
Target
2024-06-06_a0ed2bc68870deef7158d26cc205fe30_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
a0ed2bc68870deef7158d26cc205fe30
-
SHA1
02f128b87e20442f0c9607154c85b84519543d2c
-
SHA256
52d752e3cc30846183834db469e1a10fc0f6a4eadc2067beb56b2a1eb6bedfdb
-
SHA512
2e94ee73408be4f5f7fe1ee0a2c9f94a664c95db60090b761f37741f548c64eae762f59d3caff383f925a5bf1e698182b400db9895a30bfe9fde5b8bbdccdeb8
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_a0ed2bc68870deef7158d26cc205fe30_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_a0ed2bc68870deef7158d26cc205fe30_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pgbRewj.exeC:\Windows\System\pgbRewj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaAMRaQ.exeC:\Windows\System\KaAMRaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omvStZN.exeC:\Windows\System\omvStZN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GIZYKSK.exeC:\Windows\System\GIZYKSK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aFrRzFd.exeC:\Windows\System\aFrRzFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UITzghP.exeC:\Windows\System\UITzghP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIdESTf.exeC:\Windows\System\JIdESTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWbnbtM.exeC:\Windows\System\LWbnbtM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nupVneN.exeC:\Windows\System\nupVneN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRFTJeU.exeC:\Windows\System\vRFTJeU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pkYfCKW.exeC:\Windows\System\pkYfCKW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VTSRyvR.exeC:\Windows\System\VTSRyvR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLJmSLT.exeC:\Windows\System\gLJmSLT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCWrCbv.exeC:\Windows\System\oCWrCbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dWGlZjU.exeC:\Windows\System\dWGlZjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTkZCbj.exeC:\Windows\System\TTkZCbj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruNXrNi.exeC:\Windows\System\ruNXrNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXMjfLH.exeC:\Windows\System\BXMjfLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwACKZE.exeC:\Windows\System\CwACKZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSWBWFF.exeC:\Windows\System\GSWBWFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgEOFZt.exeC:\Windows\System\NgEOFZt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54c9f98dddd9f69e1c0cdf010d4bd26bf
SHA1a512f9543ba9eb1dfdc0e3e127c8bac308d7e31a
SHA256dff48db83104391430c1d17cc59f9bf4086c294921476655dca9f71bb3c0cec1
SHA5125c16d1dc446b5e24ec4931b5963260321b836d5b662082b051352835e82f4bf4ddad7cfddd6aa436fe9447fa68cbefd47c200636e1dd5dd434c4759a54cf5764
-
Filesize
5.9MB
MD5f680f5b09d6458fadc7449473178cac4
SHA18b2df0cbd907742dd870954f4eba01e51331e8c2
SHA256944a77a5518d87f577f3fa86390c2dde515018bf39d8ea7bee502c5dc74b8938
SHA5126293976f764f1069105659bc5b1091d06d430e2fb52ffc6d1a4148a471b1e33bd5b07dd83d2167055e411a2e3c2331629508cf19e8760a5592fd2c8432649b0a
-
Filesize
5.9MB
MD5bcebfd4712f9ba6458874cc928193142
SHA143642a4c663364619e73a51dd4ef79028ae0636b
SHA2565937d00ed590ff19d77ef318b8eec8a3672ec9b66bc53a80eee0a751848c1685
SHA512e6deaf11a319ab73a0950372e34766157b79f736583c4237000a59e0054cc01613dbb1f280d4e17e3bf22dbb77b08408775064909d3a1dacaf4b103dcae36d86
-
Filesize
5.9MB
MD5f51061b41003f647e8e484aa1fcc9555
SHA18fbecbcfdfe5699449c3cd29105bab53f73a3a80
SHA256eb2d223d0fc6e0e4b500f4e91fc448f8517e90c9b0b48b98ecfb539555b39345
SHA512a6b00ac5a7dbad42e82c12ccb626bc544c02c5323eff7af3c51160e638e68ee90e398f5db646978516c2161626cdd202befbf4aab86d217e51fac5b9644ddb73
-
Filesize
5.9MB
MD50ae8dbf3e440d04fcacd58f35ec37982
SHA176a55e3502ed520b0159cc19dd1dc33e530da799
SHA2560d96a99b5a12a086f5e6eb104a657e436da5fe10dd59458ab581fd40b9489882
SHA512e110d33d9cc2e110de2a0a6f31095420974938fafe5b8268b1621b6fb096614212a640a2fdfdf052ecf07ddc5ff7988192c342455fde26d936b816181daf6257
-
Filesize
5.9MB
MD5d16cd596a6c049440331b1fb1b2b45a7
SHA174ec5ce594e255d758b413eb3c629463a061a609
SHA2564a981620433b7f3387507e18a5ce08b64c3c728a729ddf7923b299854f762f62
SHA512608cd7001175142aeccfea0d72ecba25d68e90c1d84fc297f9f88b8382e752e7630a3c49130b018b8b1e743bf5e79be160b7604de0e1a090e502968396f27cf4
-
Filesize
5.9MB
MD59127e6633ab3781e56440d9e75c5baa9
SHA1ee72d1b17cc05d4e8103cd2be76226e56ec4a43f
SHA25610e8f6537656ed6aeb154aebd34e4e71094f7b96eb272f2c9f6b905ab411f09b
SHA51213a5993cfcdb20d2a4c0dd459052fd24c509fad4100dc6e8c681fb35642469fb988f62ea342420015cbc3898adaf10e3b1b86cec7c11e35ba5b9a89d20657563
-
Filesize
5.9MB
MD536335486c95259d01391718044a25354
SHA1d8e4a0634867fcb5c66f9bfbda07b5d705439454
SHA256e546e57ab69cfbb5c57b92b09ca843954a8a6045fe7899d6a2419cc1eac0f804
SHA5125f5f0c8f5404b4821e2f4e824401e1ea257decb3467028fdd769e6ad6acc04683b4950e76d0f6c5a0cbde52033e5158f581d25a35cd4346926280b09eda7eea7
-
Filesize
5.9MB
MD5f1af491d6d659db5c0b127bcdea219e8
SHA1595a9c217d924cdcbdd91f92f69340457441b3bf
SHA256b5fde568d4899673911643bdcd394a22e1391de4c56f3a3c0ca12945fd58cec6
SHA5124a3699a1c462770dfe69cd47b937d1955754bbf1f0037fdb24d4c7a7d59b8b8194383acb91ee1e8970439cb10177327485fde6e8a3265147a27e13e7746dec29
-
Filesize
5.9MB
MD51b2cb3f50760647e476e510b884e7c47
SHA102672b500e107bc4633d090f02a5903d600d65ed
SHA2565eba75917aa95f5f6dfa75ed70c04651214514e09b6ef3d8cd7622db55a7d734
SHA51254802feddc10e1f8f8dd83be2f1eca9c32f34a19a175565a6a60f7595101359305972a322294d21ae1ff3cb548c558d779681ad98ff04b359e3c5ef8911a5e4a
-
Filesize
5.9MB
MD58de406e84268330362985aad0c2a895f
SHA118a327b51222269cde35eee0666098592c3e2e9b
SHA2561a723eb3483d7f0d79341a51fe8894b70e3a19bcc669600d0c3487731c9bafb9
SHA51277c14dbb878263fd3232ce7e2dac6da571284f5a94e6b036e36cd166e7e35890263049b9f904e023a57a6381dd539c6938ac286e47d3114bf1acb46adad10acc
-
Filesize
5.9MB
MD56fae2a968268f1240b1ba5c6c8f99ec5
SHA10f55a7fa8031c670b8352c34e8304e68d5860da2
SHA256a984314657427212d1e098196778bad04a7291ac743eec5622fbad3faf871f66
SHA512bbe9d477ac831c81a672d8a9f004a0568039ff26b4b5bdf379a38b92e46e334ce5ba3a729c9cbde583a635d7d775e217069fdcebaabb33b8cceaba77784e7e3e
-
Filesize
5.9MB
MD5fea4f25f29002e6b9a135aef5a305ae4
SHA18835b4221dd81ff439a1f4e251ddc7b2b9bcd511
SHA2560c40515f8a5a2c7a6bafe67917385bdda31fdefa3ed2d83272a4e728875e135c
SHA512a7a9a51d20e00d1483146d5fda0e687268e0e1b867ec77c3b9aab5cf4f636758ac842249404d71443ea57c87e1db1753b5755b041b0419a1e7470628396f53ac
-
Filesize
5.9MB
MD50916fbf340971cfbb7f0340be9087f11
SHA1827b916bb54d8c092678a4a0784f720b5a59ff17
SHA2564d223e725fd3bf96a8a8c87825f80b9b10af495606784015e191e50824f9571f
SHA51211364c134e5f1bdda1f329863b2afeed66f9f4af820afefcc2e889d01c6129bc203d8fc16ba5a825bd466ba68583c4b9afae0c5e60a74ffddf306ebe7932df94
-
Filesize
5.9MB
MD5e895c3481f229c74d870fc114797431b
SHA1af3f8b82d4232556966f7bda71604c4dd33b4d4d
SHA2568a3b3431dbfcd331dd6818deb73a687a0bc275a972ab8a83beb6f15a6e7cc848
SHA5129176ded728f04fa57dd0f90a324df9d47981180cb27fe4a8905e46fea671abcead10f92c55681154fd6c08023687763e834398f66d357f871defc2bab1012795
-
Filesize
5.9MB
MD5b64ecb320122af34c25721979bec2e0f
SHA12ef9b6976ece4d540872549dd18c461e373c7c5b
SHA2563854be1118da46aba39eb809ea610f3d99c9724df6cc864e309b0441a2cbd988
SHA51217cf93861a5d23b5a0a9408866c83e70e5f819880bd82ac474a1638f0c45e35543a9bdd3c1344107e3f556fd88035aa90e2eb780c2de207e1060990a81b12a88
-
Filesize
5.9MB
MD5a52ee34af7bdebba91f9683988c68644
SHA15380d041fe343c618059f301a6738c79fa807148
SHA2569f894986c9d78b6d9da741cbd0343ef17eeb88e1ec5683cc59f297067d2074cc
SHA512643bb2379d8427e1e329f4e4619e65020fa32bc7a54a8dc46b1a463cef4c8676e3fd397e37c3bd834dfb4ad63ec26c49310b54dbc0187bef8450e947535ca88d
-
Filesize
5.9MB
MD51de7295af4020ebc37dd2e441e201970
SHA1b2b3c1e1b459109e40bf2a8a1834ecbea7cd540f
SHA256f2d5a40c16136e976ed31a18d65d7e85b197ffddd4e715e56dbe2d2f054ca8d6
SHA5128ed461e51a5fbb9c7d2d9d8bf7980dc4d20a5fcf2d643b1f27b8f678409efe5b58179965a47d0d9ad52dd897b303f4c9aa271b4e06915e2017ae690ac06b0a6d
-
Filesize
5.9MB
MD5897fb50bad256d504e98fd3c17a5a1b4
SHA16ee28418bc65b5e618360a38002d55d23bd1ae85
SHA2568b3bc8c500ac3712625dce88127e268c67ef8a9628e0a3d59da1772e895f71e8
SHA51233dea0fee515196c4cacc9941084c87fd012976097d037c8dc6d166998ac642eaeb067e727139e3515aca382e6a55d01d4272f2fb9854937a3aa7b6ffd2bf15f
-
Filesize
5.9MB
MD584d6d827fb61edd26c57b79cd1efe5c3
SHA16e9f02c768c0b073a73fe777c4d69b884cacaa4d
SHA25697fff8fc539ee15e512049a33571ca7da9cc9d23e2dc43337d229172ee09a058
SHA512b229fbc701ed21c1525135c5007d3423f0505cd1b6d8450fc12f247aa1bf9739bad8c0975cb1857b9e466f607cd65a1e5bd616908d44850761fea890edde7cac
-
Filesize
5.9MB
MD57785ea729042b37b8e8dd13a05d99e13
SHA10336ee84d0e1c06e2afa5144d9a06f1cd3c30889
SHA256c7128e9d58e906211257ba4c2a3f19c38c46ec0e1823160ea063a9451de4061e
SHA5122ca1fa3084a35343a03e9cecdad1d76b0d4a3c9cddd7d5625efc677ad4745ee719bcba884f4f3133a226942616c22f9679e1d8898565c5b8dc6e5e4f087f552e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB