Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/06/2024, 08:22
General
-
Target
2024-06-06_a608d83e6d1c6abb586c918ebc3fd3cf_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
a608d83e6d1c6abb586c918ebc3fd3cf
-
SHA1
7acefd0485c6838cab257bd39c7f67bc9e4af7c3
-
SHA256
dfb4b03959f53ed0ec7ec7d3dcb85bf67317359d5d3203fe0632d26405fbb80d
-
SHA512
f4c224ddbefdf414a4af5642c90946af6b2414dc19f1229f61d9a74a2ac1eecfecbd97676fd8bca683417ffb4f534a503e5c6c1c2f06fed406f9f43a3470931c
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 51 IoCs
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_a608d83e6d1c6abb586c918ebc3fd3cf_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_a608d83e6d1c6abb586c918ebc3fd3cf_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YqsNbfU.exeC:\Windows\System\YqsNbfU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrDivhW.exeC:\Windows\System\DrDivhW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WHcXFXf.exeC:\Windows\System\WHcXFXf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZTiKame.exeC:\Windows\System\ZTiKame.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UaRrsPX.exeC:\Windows\System\UaRrsPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXobjjf.exeC:\Windows\System\iXobjjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\disMIbP.exeC:\Windows\System\disMIbP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HqluGkX.exeC:\Windows\System\HqluGkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTWHsHw.exeC:\Windows\System\TTWHsHw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUVJMQT.exeC:\Windows\System\xUVJMQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgTzTEv.exeC:\Windows\System\HgTzTEv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDDsHXb.exeC:\Windows\System\TDDsHXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PRiciuK.exeC:\Windows\System\PRiciuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PupqYgl.exeC:\Windows\System\PupqYgl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKPdHrU.exeC:\Windows\System\ZKPdHrU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrunxwF.exeC:\Windows\System\FrunxwF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJfCFyC.exeC:\Windows\System\dJfCFyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojhnSXC.exeC:\Windows\System\ojhnSXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCrDuIL.exeC:\Windows\System\uCrDuIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egsqixx.exeC:\Windows\System\egsqixx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnRxUBv.exeC:\Windows\System\AnRxUBv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD569390b9bf259a9815f16eb0cf53332a0
SHA16ed64dd2817dfb5089d6d9fb43903b5dc620a84a
SHA256e70a5ea3dca444cbeb58a94cb35c4adbce14d1dce19395ed7daeb724f6843a2f
SHA512f5c48bcbc295c15c13ee2d9a1b7c9f329dd83bffed386e81f7edb68a5bbb6cc1bc8a9b6d9446b0c91e2b66f45ca645cab4431888288813cbb0c62e9fc6b6f23e
-
Filesize
5.9MB
MD5b4cd2f12ea028aed726ab8e5f9cee24a
SHA1d189fb33c0c2f3d33c81a78ad5acbb5fb0d63698
SHA25644d1feaf7e0bc9b150aa7ec08e23849c64773720b23c2c2ef1e24a81ec96e279
SHA512fff11b3e2e89909bb01631c3b6386c1667149442b934a00f386663f8b15bb4ad240bb72200b39e605edc451cd35f3713587c3076328ef2d59c811b2ca29ba2cc
-
Filesize
5.9MB
MD5d24c2ef63eecbec9ec22ec8e1470862b
SHA15d919a95ceecfa79a9b01a860a68547be3ba2b2b
SHA2562afda3e4ba093f211622723b805ca43d27e5413787b331076664bf82f873c82a
SHA51272266475dbe364ae0d04d53f40f8a1a65eeee56300e72bafc96455f2067050df5181c80de7289f0030e1443a6dc860a877f30df3e3eb85ac2f5f413b8cad5ce0
-
Filesize
5.9MB
MD5b35d83bcd6c04b9165e7c0fbb1737ce7
SHA17acf742315c83541c66c2ba1b3d04f9ae5dcbe0c
SHA2561da235b4bb264a2c4348a954e5728e8b19fcef911b8c11868515848cd2e12f07
SHA5125953453cb6e59666591f321f8aa8fb99fc76ff7954cc7f7c39f468abaaa7cae5f4d36388be77d397b4938abb95f9423f561bd247a745d0992dc7c782d632da99
-
Filesize
5.9MB
MD5112bed52a3dbd48dd01ca6a003596ce3
SHA11fc9e7b6a441dfaf595fcbdfd33c9bbd0f46ca08
SHA256c76b6652b425ce52221dadb9050824d1c9af67868b2851212896364a057514ae
SHA5120f3767e8eef4b1fcf60d22b9b65121d81ec8478d7c7692675ccd4cdc6148504ad5aea4009d4205b95b87cce678987f380bfce49db0cd9b28f6ad723ddf4fb0d8
-
Filesize
5.9MB
MD54f76356816d48b598b23f206ea3a1c74
SHA1a38d2109f5cd8116006c071e9499a9d7ba074b73
SHA2564a4da3ea21214a5172fb37e08514abc2707f1cb7c04800b321c3883941b4cbfd
SHA5127306f5ca0513e50e397bd1b30021893ea99b63411bfb6e909c3d2b5f90f1b4d563b51b8b3fcced497abbf1955350d01bcdc2b7fc951835171942566e0e39a895
-
Filesize
5.9MB
MD5adebb5516d854b1b6ec9490219d08a70
SHA15261e8bed414aedc0019c5769bd10ecc25733fe9
SHA256dfb9351ab42fd6fb9a3955b1736b9c06522b317c5419f830c8080fa4333efda8
SHA5125e65b968dd1da6a0c6a423135f1d3a2c6137278ec7eaa7f1a878e39dd02bf426136b2a7d47d9c7031997fc37aba372781a813036e90dd0e4e9224a24e362e36d
-
Filesize
5.9MB
MD5c36f32c812d0c2693552e001cdb6ca19
SHA116395fd93a6c194ee831b26ce87e3fb16aa9503b
SHA256fbfe9571c4c441d5558030ae169c45eb439412d559b5c73a8fcbe1edc98c8352
SHA51231e7ffc4c76c6c1e024cecebb1586326913cf18f15009b51b0a3c5145f5e958a7eb265e478ba08c9e1d5d22710cbb6eb5844358c2bae2fa5d50b6a58e5d621b0
-
Filesize
5.9MB
MD5db8deab16d8d8f8f7a2c3ee31bc5048e
SHA1ceb44032a1bea4ba580d110da2b9ae943adc82f3
SHA256ad5c80c017fa32c0ba93e46e47736c7ad27619c84a9c440265e4ebab5fc84d32
SHA512ad74b8b956475ca0d7eb23098113f6e8cc6e95bed31695b26b6acc1c3b9e41c24295804bc6235a265e9916b7dff11b273c2a8b31ce5b168dc32d2e03a9ee7e48
-
Filesize
5.9MB
MD566ba8a40773ddb28db97ddebb1589f85
SHA1391a9382d4284ea53688c12a44d56cbfb452f80a
SHA256ae6e73a0716530c5059d97a582b1daca68d6e35577db20898388bb315e71285b
SHA51254b8fb8628bbdcf5c99455046d80c6dd26208f0c5af5e0c894ae517c769250e11119b1db710eaec6e0217779838657c24a139b606f211a1d4a2fcbf0c5d09229
-
Filesize
5.9MB
MD5e1b2ce9968cae25a708af8f049b36cd4
SHA1617d61c9d04e56a238dcd85d933c266877e1ddbb
SHA25657010d70546db4ee5f0f947d8acbf6ac5a7dffd0b6f783da0c6d5e688354c2b3
SHA5129921e1ad0d002ee75ad7de9974d48a373f29629d1dbe9008614eb378df2dd87b09cd3910598582765e057a13db3738c1b55cb32ea854b80eade4bd0db1fec9de
-
Filesize
5.9MB
MD5e2c7eae65a8ba914919a457b7d6e6e03
SHA1f106046e3667ee4287604e54336f3463677bd6f1
SHA256f01ce4b4017c7b7d24de38a8b6d72b0793d54ca13c7933988d5155c076a4d06b
SHA5126ccea9c08417acbbd56dd206522c029c3ad395455134b8403b33a329f6bd0668475767d0185f72c2b2f1d40465e89950b92e6c0d7a6c0e97eedb6c800cfffb8e
-
Filesize
5.9MB
MD52b37dcf4341b0eb44acb54791777a9ab
SHA11f6d12d17f21325bab600554fc2268fbb859eae9
SHA256b6ed1370f7ffb5fb941f122f472526062e767f512432557dae4861a45f80e823
SHA51283e0fdd91a0019779e41c26e8f29ed770182f5b1c583a9a5a507c0add636910f8c57cc7770c1ff68bbdf8ef4e7f74aeab15483d0a64f4b81c527de506e42a0a9
-
Filesize
5.9MB
MD5d42d03cdc2055080110efa98dc9808d5
SHA1c784e364a68d00b83a2456e1818c7108825eb18b
SHA256139065ac19d9edc2ea17555a9413c241f9899dd83215361944759b6583e4fca9
SHA512a7716b67fb6499b8ebacb788840f5b7120de13dd4a09a139582685be750c41d6edbf8c101fc8f4eab0b289345c9068c6fdab3d6013adf548b5c1b28cac082371
-
Filesize
5.9MB
MD5bd90a224383e7ffcd96d4e817f842a82
SHA1098934088deb92b7558d246dc5c0fe6e24012b31
SHA256e7140c16e0dd09eaf1e622370f114139535560443fff9f8ddf324db54fd35c9f
SHA5120d1e9f7ad4c931776c607f268ab2e28c7b762fd0b35d67e118e55617c2cdbe00ef1425b8805d793d6bb5390173ab86888300d74780426228db7f4d44075dc759
-
Filesize
5.9MB
MD54eda06cb49aa5000c0bfa98e26b6369b
SHA1074b5851fb21a1511ce068cb5af98a6285bf540a
SHA256fd0b7660b4b6206b001b6418c70ff73bccdcaba9597809a60e64c061424fc780
SHA512736015713c2caad091d490650c8c9cedfcb1aae90193a6e1556d6c1be6fe82e603091f397020a0c1241e8bab72f44e9f2a9ffb08c64dd026582d50679e3431dd
-
Filesize
5.9MB
MD5a07950d608494aa8a9bc1c86cff8c422
SHA1bf1bca917595e5c35799c79a5793f4061cc8972a
SHA25666d4cc24d13c5d96414c56a15e0626549eae65c2874606f4afab53a80eef229f
SHA5129a93ead98d225829932466f7075226bf1dd3941450e4701a0f9488c93eed1bfbc6dcf01e0cf580138a10a40ff17cd7e7f11412e56cd7ad032b83453cd306827e
-
Filesize
5.9MB
MD57f346884db5ee19920f03561b7751c87
SHA1edde016eafbb0ee52d0eef04c1af75ec4b9bc567
SHA2563c6ba38d50128fc7e4b63d9ed3bb0d06c0848d654cb7528650389e20c7498dc2
SHA512813222aede51f5df1d8c99cb2b016ad9bbc96dab515dccc7b7b9a34884a7c4c96e932b85b4ef4a1cbbc77c165360fb16b1973d425750b7b0a71cca06f0038b16
-
Filesize
5.9MB
MD5dac6b1e9cbef1ea283b9d6e3c19f99be
SHA1a15a358d90c23f6c78b92ef48de94e18176088de
SHA2567a39cce079d91a4d4ffb836926b1327e3a3bc6f200b99f4ef89df952eebcd3ae
SHA5129b5b6ea164afa2f3edec3e07ba41ebb0d811e3f462fae1c3585683343b4d6112c77d82d7fef259b6cbec72cb0cdebd3c49365571c5c3f4bcf10cf437a2db3150
-
Filesize
5.9MB
MD555f17cb48ddd89a31b7abb0068e7e086
SHA15e5f7f3b139c6718a9ddd0412b44a8ed3c88c75d
SHA2568f096061d78e6ac87c71f351a48893b6d7d87d72baa62dc14dab65c74e17ca2c
SHA512e59ce8454724c0c9f7bec5b02d4d66f2463cdc1fc91cfd2f45a952eac65383228a11f54fe420bee2ad1af0d9dda9c52de63d9a9063d3c5868ff4f97f67639f09
-
Filesize
5.9MB
MD5a7743133c8b6bdce8a6889ef2f6ba739
SHA1d5063a7ae786c3427624e6ae7c8ed44252d1686c
SHA2565ce559f50d4568580e911cc58cd3155d5f19575e07e3b36db5331453e6c20cf9
SHA512d275f7bd293ef8d9417f50ff90a54c5a6b1f38ab529e98203a06f411ceda624787377a5acc0f7f5f298ef1ca9e206c0b429584a8a1942e2d707710fb1ca1d5f6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB