Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06-06-2024 04:13
General
-
Target
2024-06-06_7ad40ad09fc1e6b3d23a3e62eb441264_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
7ad40ad09fc1e6b3d23a3e62eb441264
-
SHA1
4d557bef036b8d0551c07595f84dc64396ccf462
-
SHA256
a0602c42a960a1b22c7f3c678fb3d6180ca54ed9f6945824e2cb4421c2b1b0be
-
SHA512
241e40798b8606858b6dd6f88cddc8fd76c6a29c7b2dd300d36142af43bbd48ed453a361a9b52bed2aeebc0fe7b4e347b8f812353743f244fccf60ae8096c7cc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 59 IoCs
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_7ad40ad09fc1e6b3d23a3e62eb441264_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_7ad40ad09fc1e6b3d23a3e62eb441264_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\moTwVrH.exeC:\Windows\System\moTwVrH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWrNDxm.exeC:\Windows\System\eWrNDxm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdtwqLX.exeC:\Windows\System\jdtwqLX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwDiswM.exeC:\Windows\System\GwDiswM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ITIuLzG.exeC:\Windows\System\ITIuLzG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJJhgpC.exeC:\Windows\System\hJJhgpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtBaSvW.exeC:\Windows\System\FtBaSvW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLAebOt.exeC:\Windows\System\gLAebOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWMEYHe.exeC:\Windows\System\LWMEYHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OSsBuTF.exeC:\Windows\System\OSsBuTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MzpzGYi.exeC:\Windows\System\MzpzGYi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUvrebN.exeC:\Windows\System\pUvrebN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hcjcYwW.exeC:\Windows\System\hcjcYwW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnkwTcn.exeC:\Windows\System\VnkwTcn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MPujKkn.exeC:\Windows\System\MPujKkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMwKOJi.exeC:\Windows\System\AMwKOJi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERnhdYy.exeC:\Windows\System\ERnhdYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrQJcNE.exeC:\Windows\System\QrQJcNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NWRsVIw.exeC:\Windows\System\NWRsVIw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tZtsfpH.exeC:\Windows\System\tZtsfpH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pacLDib.exeC:\Windows\System\pacLDib.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cea92a8c8eb183d39d74576dbc063716
SHA1de5d4ec6d5bdbc8b7e42a6beee131640c73d61d0
SHA25625077acad27992d4f7be95f3e671b4a6052858529c47c31514ec72e0731d5636
SHA51241c751cf5b2b3003c6c6b412b3ef256614ae8d519209b0b62f092682bd250dc131f5ac2d5ffcbed6152f03440c3bd0693c489d6b238e7bfaf3e2bf3f72a96a79
-
Filesize
5.2MB
MD56b099f42e5f75213e7622ff8df96c8e7
SHA174278d402248377d6fc270fcb3a6d4141ba7ed3a
SHA256ede27e772210fc7793508e6b06e333fb8808f90790a026ca9806b6ecfda14b90
SHA512a76e622ac2c9551123a8a43c87749c61eeb4cc74bd6a409b091cc47a1a5b3ecef24338026a2573493e0e0a42ed5f76d270cecb8ca789d4a58c634d2c3c2b3169
-
Filesize
5.2MB
MD543def7cee0a814ccf488052674fab678
SHA1e6b85cdd5ec3b2f446bfdb622498277706abc431
SHA25693961aeab8cd75d52760eccd189d4aa4dca168e159c3d83943d245353495ded9
SHA51268472a4421d56f8d629ffdfc6e2f7f2f82cb81c8b31609885765aed2baab23f8d17f365e5873d7fbb026ead5dd919a746ba4b933d1656efa87f872bd1a5f3607
-
Filesize
5.2MB
MD57cc01b01c25d202f2291e2a7d5966e82
SHA1b9ee8ebd41f0766e30c46e75d1bb58b7dd7a4333
SHA25642ec823999f794634122e4d45d2bffc508a2d540e4ea8709cbc7d5c8ccf77551
SHA51251c6da47201d5cd41e29c83a075c5e0d7256c613a359eb1f59c42fbc3a5886d7297c59e354643c4b0f768514c89cc5b22877b01f5fc99cad4dfaf5d743ea58da
-
Filesize
5.2MB
MD5ea26afdcd64d1260ae41e6bc601922b1
SHA155d817988e66795cc071839ccd667ae612e12589
SHA256555eeb92c79fdcc0d633ed5c3fb2d7aadc76dee97ddc97a12dc0e6c28fdf2dc1
SHA512aa49f18ed12de58bd2bc81a57bf0ce36064125cdce93ed49ec7d25ca86b351b57b492883d3029cf94c2156b837923e5d4ce6ea3cedda29562936ec80b06a79eb
-
Filesize
5.2MB
MD5be3ff993a2b5b352ce7f2532df736463
SHA15b15ce1e24fa3039bf8197c2f8b46e1d25494f66
SHA25633296fb40e70a6d9ae46de53cf022941e98afe978bd166dd527453c7f112dd78
SHA512f0b654598a090fb48d409d63f858a01e51bca82bd47e4676524547bfc8a280804a1311d20b2365f0b00d4f74d6f74afd36ff6db6929bfa72de9a45904f00665b
-
Filesize
5.2MB
MD5c2126a39d5530cf072dad1b5fc17cdf8
SHA17eac2690364bae114aa3d60b7fa95a334c739ad3
SHA256806a7b84cbe49e564cbbcca115cbf9296c4f4c5324a2648f246134d6a232fc58
SHA512c5efb29896d61f0b6a9f4025c95bd08b54a141821c265b7684f066139b483720fa7331f2e2e6e7ece3820e626cfb2dfa2aa75116ebfc9af360a0e59f83eb3c15
-
Filesize
5.2MB
MD5cf8f95a4a6f5b8eabc1b34b2b65f2791
SHA166466066846745b2f9fcc330f5e50c9c93d2f482
SHA256f2c69713ab04a810fa00cf03cd671e1a2ab2eb580d078771663eaebab73008f1
SHA5126ed9fbc9236b0ba2a8f2b763b563646b54e748f99c9c8ecf7efef9c6c890967d98f6bb833a779254807af61f456b87f83288e30e88e58f81e9ed827495413679
-
Filesize
5.2MB
MD52424719f0fc906a0ccb18f3885d43c22
SHA109d5f20107236d48d168a80f9a389120a3176c62
SHA256345bdcd46a87a1a42b09a630abb0ffd47021ede1a96f651571a5108f11c75207
SHA5123e8c700d5d95f0ec82f2d0ea10420bbab151584134d6cde43ce56fc34d61b523bf054677326ac9a777df7c7dfa4f0d2728937fd559a506c7b29a591304c188df
-
Filesize
5.2MB
MD528be99bc5963b32012ed9fb244e06fa5
SHA143d3657fc8dd05e34f29542d3d071f2c6f8d1e57
SHA2563d4b6d3160be4ad86f24cb42f376f2eea2200d74c1bfcf9e1c18e364ebbb5bab
SHA5122aab6737c12265da914649b1807637d0e5d982bb1c5f3e201669413c4e8fd4f5c9d172f04282399d00c3e9adfc84d8bb7ab462b9911412d7f3c78c8df15fd48d
-
Filesize
5.2MB
MD579f20540bbc927993c9f7e52542665bc
SHA17adc34d4571166c754004d8818d7a450f41231d7
SHA256c973b0d46b974933ee3aad8931747cc73ca2b214227b025781cef2df0cdc6103
SHA512a4ec2f1bee84d593873baf50de7918528989c2c45497ec3e8d52add94144549f475341a191024201b3364a3a2ad32fbd86f96672e1b673347c5d80aa590f5219
-
Filesize
5.2MB
MD517d3da06974f836b1bea48732250dbde
SHA1bac48c70029c49bdb94e61151fe5604dfc536162
SHA256cc296bbd6523c0e5e315fad3c67621f6cbe70725be696fb9a047aee1c465742f
SHA512dfde0e8c3ed75aadbf5e166437b7aa72c67bfd96bccf357573216119d3e55e0ea8924c22630432d7992551ea1fe5b601d49ace356a7e3d43d17dc7135b23e44e
-
Filesize
5.2MB
MD57f75eb9a7c8906ca763256a16e7403f6
SHA103707ad8ee400b69209d6e08190b53b40049bdf0
SHA256dfd5930271d3886b08d9adf98d8f9dc121e4f5763c81d43d713e5c67327db608
SHA5120746980366de9c2dc4e8695c94e84844ba50932ceb3524d3d466e7dec6ccf481f3291ee99fdc8fa014973fb4acb9c43391a1eb451ed1df35f1c27cefa6adf6b0
-
Filesize
5.2MB
MD5f5ad2b836709b6ce19f2eef46bfa020e
SHA17d43b37a8bc7491fe3273fbd42f0542db825ba72
SHA25641f168a023d2e9e85bd21d6470c8cbea3523d693c7ad75487d231c84952eddef
SHA5129f5e099f3257dc302dfbb54eca003105d223fa85f136db902b67648b42258b82323e8788345aa8cb4fb0d9352abb85790a3e06e240cd48c20af220a5399565d6
-
Filesize
5.2MB
MD501f353b14e47c9b5ab6c9a80b339d5af
SHA1691cf0c52a95c1ae8d783146679a6463baca85c0
SHA256b21d55cc9c5a30b4127fe65a3217450384b2b436ed0ca6ae4bcb1e1027c46b2d
SHA5124eb4f7a8ed1d7cfea013f9d1f21d18becaa6f920308d7489a5d43d7a37b4aa9c1127f6c3ec87468082b7ebd62b535aafa694eb6a2584bc6caa20dd1c2b65f631
-
Filesize
5.2MB
MD5698a6b71645f7f581cd24a03c2d75b72
SHA146b4d4b05ef8e763986d5714efb8aa9f73765fa2
SHA256e5b76bc30eff7cb955d18bfd258828da1d65696f9c815fb28a96f6aace9039e5
SHA51254d90133e90503265220c8c84cc1ad44ac0f4fc38087f3082c77043ecf8d126c5337569f34e8bcaa48692bdf6237af22f6e34d137b2326dce8767091af6332bb
-
Filesize
5.2MB
MD54e8c49ccd4f22d28fb8916c3be6f0d63
SHA129ef031e40c64a260644a84320843df8efb92cc5
SHA256379d1442e376152313c109689599fa4979a5e7a46d55f1690f03a67ee5f311f0
SHA512c864cd886d0c9b397e1268863e4c81e0f2ad8f6c5af96998bd2f15df72664a67999d48a77660aa2f8adef7a461e61a118127fc4d61aa455b6f5d7719d342d2b3
-
Filesize
5.2MB
MD531f05ec8caba8ccbf70f00fc999c8796
SHA19656219cea1e43ee99d7094e718f9c6aa60e46da
SHA256edb0607a48e5c4c2c996fcbeb55368fd8ec8d059784b4caec4922bb5a922e9ea
SHA5125ec7157993f2e748e22da15d4144787a1a126215dbb3407d8e77eafbb634bc638c10ead808c90b621e1156740397959bedc8a7c6ccfc26bfd166b4ce424672f4
-
Filesize
5.2MB
MD5550177bdc7f9d5bc292beab71e528376
SHA1af5042d4eaa34d4bf9c9dd0fd392aff52349f284
SHA256f706e82b90a337b37085c6d468fee33c6db00487648304e73663ed2ea86d4b49
SHA5123dff85f01b7af8fd70b66d67e20bf4149566c8d7adfbec98c038f8ae77a9ee1a42158aefed5f005d82ecb031bccf164399744d968f333958eed129454d44230b
-
Filesize
5.2MB
MD52f9e94f6e426c4cd820f27777a9008eb
SHA1e93551c24233d84b079122b560449850d1d30825
SHA256e5194483db51a1a7d8c886b700aa9846163019ce88079a95557c85880a7424e2
SHA512eb4e77da0b0d1fe27ef849b92e70e69c8d904e0ab897bd5f6d71223554b5840f59b5bcbf7522e83d7941a6ea0f44d375a61e17c8f8e1a9672c26fafcd714bae4
-
Filesize
5.2MB
MD563462ba367b8c5692425b88884b8fd4e
SHA19abecae968f8aa41ef5ad2a59dbc702fba5ba5bb
SHA2560242332639ae94edd65cd9783cc55464ccd9b34e89d546c16a1f01b146afa61f
SHA5123f01d7a91312a7a33f53af1cd457a000715970000b8febba01371cac51820c19f22d5a09c4d067dddd532efb1a6b6a90de8f6357fdede5e3fe47233bd9fbb768
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB