Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
06-06-2024 04:13
General
-
Target
2024-06-06_7ad40ad09fc1e6b3d23a3e62eb441264_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
7ad40ad09fc1e6b3d23a3e62eb441264
-
SHA1
4d557bef036b8d0551c07595f84dc64396ccf462
-
SHA256
a0602c42a960a1b22c7f3c678fb3d6180ca54ed9f6945824e2cb4421c2b1b0be
-
SHA512
241e40798b8606858b6dd6f88cddc8fd76c6a29c7b2dd300d36142af43bbd48ed453a361a9b52bed2aeebc0fe7b4e347b8f812353743f244fccf60ae8096c7cc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_7ad40ad09fc1e6b3d23a3e62eb441264_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_7ad40ad09fc1e6b3d23a3e62eb441264_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\crvyaWe.exeC:\Windows\System\crvyaWe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOLFwDT.exeC:\Windows\System\dOLFwDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBHHzYO.exeC:\Windows\System\qBHHzYO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XpJuhJw.exeC:\Windows\System\XpJuhJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DiZJHKO.exeC:\Windows\System\DiZJHKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SZWSqsR.exeC:\Windows\System\SZWSqsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buSdpiL.exeC:\Windows\System\buSdpiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhlicrZ.exeC:\Windows\System\UhlicrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EZdDgxg.exeC:\Windows\System\EZdDgxg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XisTSzX.exeC:\Windows\System\XisTSzX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIxklDy.exeC:\Windows\System\pIxklDy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xtIcekF.exeC:\Windows\System\xtIcekF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OLetQgF.exeC:\Windows\System\OLetQgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPTIAuo.exeC:\Windows\System\oPTIAuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnvzIAr.exeC:\Windows\System\XnvzIAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RlnqlPh.exeC:\Windows\System\RlnqlPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHOPHEI.exeC:\Windows\System\GHOPHEI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QukCEyn.exeC:\Windows\System\QukCEyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhZNqEp.exeC:\Windows\System\yhZNqEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HMvHyzt.exeC:\Windows\System\HMvHyzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HtECnJV.exeC:\Windows\System\HtECnJV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e15c96140151c13970bffc2acfe83cfb
SHA1fad6db97b51f955949e5c8c9984efdfcf3e45b58
SHA256b542ed0e8ddd391ee9a49947f8eecd2269ef535af213285a2fd3f4ba27f33d69
SHA5122da8efb94e87ac9bc96dee35c73222fcc1a7980742d11519a1b26ad8cb4291732ad777aa104d76b7c4da7372e71ffecad075b2c36f670f6e2c51af8909ea1a35
-
Filesize
5.2MB
MD569c3e76812041e498c1d5390f367f8e9
SHA1f58a9588a1da26fef6b6e97fcd6b178b8b29aba7
SHA256b0cd19103d6a9b021792e7dc33cacc4a952152f5d4ad11d368d179d33d4f79da
SHA512bb9e2eb362ae7695ad785587f37570360d29e835d1bc202dde8af7840e46caa321c9355a9a61499db9ab75b9b56b1b16e012d5d1a1bfdcb138dc10fe3aafe133
-
Filesize
5.2MB
MD522785f26f34473581dd83c4daf39d8c5
SHA11fe0a3608cd5a400fb58734bb05e03bf2209275e
SHA25647e8582ad337896fff019f527a96f944f972713eb2036421cda7f2c4953a1ba6
SHA5128d1a65e870549f9ed4d22a9fbb37bbb0b2e1fbc544aca5fb55ff0c7e32b61ccc0ff969a06c2c0998c12249b6576d04054ec93fe02b85d33fcf145c591e9431ba
-
Filesize
5.2MB
MD50e989a9712f5d56840443e6100786b75
SHA1b7a0ccf1a2e23a1a318c960b4cf90e03235298f9
SHA256cfaeceb9ec95892e3806c40615af8293a4e9c5ffbc82a9672a4106e92ed9f5f5
SHA51285da6e99c65b809e62fc5ff640020bfa0e80709fea7db60f424dd8bac946e8f92757f93daa469187c8a7d9d5efb57b8a5bfdd5ceed392d4a53a572c21e704f08
-
Filesize
5.2MB
MD5202dab811afd556c7ee4ea17af7c3c9e
SHA1dcdd4e3986b44272e22e94ede8b338098073f1f0
SHA256cd58b0325eb4709e0e9c4a087d153089b064d146726c40f588cf226d106adebf
SHA5125082975967ed10cf63e18dbf25a26388c98c34137a1c6c254500042433254160352838fd60c1d1edf1a0dee8d0a7f34517aa0ce4f60f9c7739db13b6384dcdda
-
Filesize
5.2MB
MD559394bd7a4ea40e775aeee9ee0e23b75
SHA1479083ff1347363294292c0dc1a493bd6405018f
SHA256dd0efb993708f84dcc39e372d906cdb22fd1fff0b8617c8b2e43acf78d311827
SHA5126666f8038dc4fe813a95b7a5c318d6e01e23958415b8ae0e1684db3e07e5f978e9ac5ab7eea086bdedb2ba3e5c9a029faaa276438d427c87152774f9e117bac2
-
Filesize
5.2MB
MD5b9c5db7a6eb2dd837e3d5c9164d19330
SHA116a9af90e2af70794dc530fda90b76d4a4694ab2
SHA2564ac06b5cb1b668519fd5ebe7d312fb5d81379d1296ef51baecbd9cdd4d817709
SHA51233157ed6aa3c92ecdb0719fd2152e62673e8880681a344f81d4f18e2884c6fbfee0bfecd3dc2fe08c5f2e89052b957295f69eba3cff66ad79b814d863b58b4cc
-
Filesize
5.2MB
MD55db0a62089b63b4034a2a5c24d2aa449
SHA126a18f629be5c2eea3b7209dc06622be542c8e65
SHA256d226e6647db2a4aaa5beae32846333ed1d2a1a60ee1cb3f097ea0639ac86654d
SHA5128a09b70e3f7a96985d22af4974ed5f46a3b1ce02c81599c7ec91fa18a9bfb13f92ea77ca5c0a6641eb560f05cd49a039e056fabfea3457222c67b826e7cf008a
-
Filesize
5.2MB
MD56234585c945b1f84e0383e9defbfb51a
SHA1150e9763bc85a5e11a0d3e25a959cc4d815ace19
SHA256bad998f9225e5034c3db04ce1544775fbbfad9d20a9dec4aa51a687bf5ab0a2d
SHA51200821f1d48e273aadfcf6281b043438e8ec03574b8841d92b7b15c8a990e3e208783c9dd694ba7deb523b78bc260e43ce95853bebf97ad7d86006554cd827a24
-
Filesize
5.2MB
MD54373364f125a7ea601bc1358105b6188
SHA1d242304aec84b498218244e2591da7747e192773
SHA256c71fafec64b12156228c0a08ec5553b5da3d3cec52ec03569f3a8306c4dbbff0
SHA512bdf4aff7fc264300905d115529ff7c049cb3f7096dfb63c2c055d8062be98b2445b9e9bc069f27c707dc72f08d0df5afb0dc8446288a5abfcf96127939ec26dd
-
Filesize
5.2MB
MD5c7d873e9068273ddd99f5af45f020722
SHA1f527189da390166e9c8431816fa6af407025965b
SHA25605bce00cb276697370f2f1c51bb011d199ad4a887b73cdc76cc55332995705a2
SHA512f90e6c4f4a0d75c3b5e5fe7d3bd75300ee04aabf0ac69073d213329ab42ca5b0e874bbaa6b177b0d65297ed3b2efc2bec9dbb4c2d3ad3f3c29735a5523492646
-
Filesize
5.2MB
MD581d81c66e3f7cb37e186aa39deb47310
SHA1659176fd0ee278bfe2525e41ef08cd33bd1d66ed
SHA25650429d1e55d298735e8a1289944a74a943e9baeaababef57b5d3f2f3e68891dc
SHA51218237cd09b3c42d770b24a3ebd2d978b12a879c83d2d134047f92054b0f0dc1618e58b04578b30b4fd1999f030f03a78c0e8afe718d2505d55b3fdcb6a9958ca
-
Filesize
5.2MB
MD5d0f7c4f9a839a8b2e62d71956ff4bc49
SHA1e1aeec57fe9ba5698709b42e718fc6d93a5c891d
SHA25605eaeb44bb31d6076b4fd749625683c759f05359ca612b31219c138d96db8df0
SHA512c01e95670bff7c4518d486f111c8a3ae46c17cb282ecc312f57db133a012b2aba5b02d7c062345c5c63f5bab7708b9ed0221ad12632e81be2292a78743f2a29d
-
Filesize
5.2MB
MD58fb00789555ad3ad5f6cee3115b0b098
SHA1eebac8fad76ede1443286d3baf6f8d3bccc0bf3e
SHA256720f883daa4a168cb450853c621eeaf7a43cc19b1f2dd7e993b5003e3fd3314e
SHA512519faaf290225ecc5d978883c7a3884b60b4b6906c8e96ac70c27ecc528932a481c4d418a59238ee4a52ca978afe455d1ca238785cd10ddd1f8b42d430b617c5
-
Filesize
5.2MB
MD5d2b8534d828475cb231c9a1882a1dc2f
SHA117d38f001c41b8811d957535b1bfe3497bf743df
SHA256ded81c0d5848f7c76eef99c5ee9803b073692439bb38c3c53fdaa0979294ea40
SHA5127a77796a980b53bcc091cbb529dbf597eef2aec4eb76e0fd02418f9463609db138c90284e075aecab1e229d43749f39931f4dc6918ed2f58e9ee15e1e4c15832
-
Filesize
5.2MB
MD530d0d4f59b90fdcd730cec51e8c8b5b1
SHA194eb0d6c63289ab7023ec22dd056cf770bc25655
SHA256c2f57b503d6547d0ca820e9b9b7d2828fa779e3adb46c7a057dc3d41e91c21ce
SHA5120a79d33dabd43913cc047c71a6762b0bc99846afb956f6af884cabae84c304455fdb9b965c9bdf46b0c22533082fef4b60321bb72dd4c55be733c2d7361b68b9
-
Filesize
5.2MB
MD58912ab0ccfb86e9e7b27c2efdf0e3baa
SHA1c8d7464de1f9819f402eb4dd4a973daed9102e73
SHA256ff9ccfceeda5811209b9ea8a9b2f67d3b8cd058d2e4777ff9153fac951a6bdb7
SHA5129dfab9c5b79d43cc81ae0330e7925857e1e8b6e14e9e54cbd7c6d1072f6bac0927d3a06f1a0e22845e02c3374fc20a06eed662406407ef72d1a2bd57ba967dea
-
Filesize
5.2MB
MD5cb5b3d362954a9c51501ec039d17c7ac
SHA1f357d33e0bda6eaa543001e443738b9239095cd8
SHA25650f979deea5a302aedd7d9deec47c2338bcb6cc31178c4ddd6fddff9602fd360
SHA512c6f817c0c16c139e521f52c5dc1a071ee681dff3d2ce775e5b91d94982b5db99d8d9a439e4daf5f81fc1aab6d4b7a5c497eb4bd25bd00323053c96c5a1cb0851
-
Filesize
5.2MB
MD5317cf88a9f743de416aad1b969f6be5c
SHA1b2bca09dbdfc36c447bc062e802c7eb31e0aba69
SHA256d33cedf52ac0f637bd1c8fafa96ed64755b4fa6892d951430122f52d1ab47d2f
SHA512e087506adc251a9d7fa3c96666816c696cdc47ec5d0b29f7aeaa2d7ae90a146f46a80e3a359659e709271a4ab655af6f3103cf3d2bb2193a9c2c34a75dda910c
-
Filesize
5.2MB
MD58337262b4b542651919a23ff46ca546f
SHA15355f413c0d2d8c103d9a66a3437713840e79a6d
SHA2568dde5e04e47b0c9aeb74c5802876c2c103e25d55738cda9a1b9fa4dbb63eb18c
SHA512f87b6387cf346e1659907361faca85b5e8c51f503da21711360ba06d496e765a042270f6f98af88ed5f7f4656ad0da315141da3a47f688efbb060e79c6b44d23
-
Filesize
5.2MB
MD575732f35913e5b72df28d48193455021
SHA1984850468d745695b49aa49b46336f80e0036fce
SHA2562b4aa3da0fd7bd7452753720b0267add1d6295bfde894a71829a5501ca1e8c60
SHA512a170e099ea41820150ca98a262553875bc81a0c4e2fb9efa5d2475eb635a161799dad68d6a2f91bb9ad766b6dc7db300ded8c44cd4bcd249f0514ae787d8e454
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB