Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
08/06/2024, 19:00
General
-
Target
2024-06-08_4cfc29f6c35a40f53f43a1ef2b43e2c3_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
4cfc29f6c35a40f53f43a1ef2b43e2c3
-
SHA1
12e4c3db94261393540de7386d541656f76c6681
-
SHA256
12257de66964e2675ff29adb54eb651be4aaacbc09c88d9a100a6aefbf309cc9
-
SHA512
baebda461946c26128ca25cf95444c4b373618716c61dd5f812b4d955467c6f543aa9e0086bd57e0c1c4200202ef157878d2718f3408550b7faabc3f0374a463
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUF:E+b56utgpPF8u/7F
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_4cfc29f6c35a40f53f43a1ef2b43e2c3_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_4cfc29f6c35a40f53f43a1ef2b43e2c3_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rDOptzm.exeC:\Windows\System\rDOptzm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrGzXYJ.exeC:\Windows\System\UrGzXYJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjqJTZt.exeC:\Windows\System\jjqJTZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBzxhlJ.exeC:\Windows\System\gBzxhlJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PebxNfs.exeC:\Windows\System\PebxNfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PiVFsRg.exeC:\Windows\System\PiVFsRg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMKnYUz.exeC:\Windows\System\LMKnYUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhEGjdy.exeC:\Windows\System\hhEGjdy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtwUCkw.exeC:\Windows\System\NtwUCkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HYGsSap.exeC:\Windows\System\HYGsSap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmtdfJa.exeC:\Windows\System\CmtdfJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vbfGWoA.exeC:\Windows\System\vbfGWoA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\skmpPLz.exeC:\Windows\System\skmpPLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIEsfgM.exeC:\Windows\System\NIEsfgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhkvjXQ.exeC:\Windows\System\qhkvjXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFaaLOh.exeC:\Windows\System\TFaaLOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRTdNUb.exeC:\Windows\System\hRTdNUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwlKWFK.exeC:\Windows\System\wwlKWFK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\krjnZZN.exeC:\Windows\System\krjnZZN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JMWUmev.exeC:\Windows\System\JMWUmev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xFSXunD.exeC:\Windows\System\xFSXunD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD504803263de6a98ec8bdf94551c738ed6
SHA1a012aeee601d22e3e90cb6af75bc2a8e3bde51bd
SHA256741e0197fae9d26fcfca09f09ab25788bc170e6f5c2477c8dd1a056d470ae985
SHA51248f6701ff59e0d01fe89dfa3a79ae07ae97f93b685dac1a98214b566d334ae3a8aae787d547f7f750a0923c187861a4bcbe1daf92fbbe30a613fbf90a091ebb7
-
Filesize
5.9MB
MD58316d07967304388ba63e05c1a36cda3
SHA1409dcfe6b696040084bea7c988ac2fc858f6d3a9
SHA25605db63b2994e06bba477940aef82865dae03a3162295c34a3ec1f54540061092
SHA512df0c2f28f7f0118ba26962d198e51143d2f8c5b16fb8ab82d8196681771640a5eac1891561a0f4525d4f56fe88a40a98d4c4f81a155b9ae15d07275fd882b1dd
-
Filesize
5.9MB
MD5a4b0a880151d24ab8004cd072b6551ce
SHA17f5c77750e62921f6877d51fbf88f7df64b77ac0
SHA2567126300f2a8572ead04245c15d1ae249ff30be416849c96919a2f2cfb12ef55f
SHA512daa6361529f4eb127847b49ac8c441de9d8d5ee84241b7b951df5096480551446d84249d92a94b996f8589bdf69fe49097766091b42fd95fd68537e2ade9853b
-
Filesize
5.9MB
MD54c1ca2f3218882be36aecae98274ef07
SHA1999620ef11221658ec04732efb897d6429d6d4a5
SHA256b8a8be9f648d0ed0d29a21d1ef4ec8b4f36874813f087a83c5351de8aead2c88
SHA5120122f136ba4efe7559d6893ffd2d1dffe590c5a8e0f6286791db3ec5f7e4f584136031f9ccadf01e53bb9faee78639b02fd6b4ed3f4496877db44c6824060252
-
Filesize
5.9MB
MD517749cbe0be35298386793058fd8b7c6
SHA18e78a3c4c9951c5e242fa3e6a6d1b27cbcad0df4
SHA2567d416ae913167ab64a8effee84336b4bfd1bb69f056f59d9c63f08ee70305f64
SHA5124060dbdef16a4b1c1daf927061fae3e35c69d1169c50c0c233c5e9b6378d9f126b95068986b270b816d131795196eade8a7b4580f86c838c9a8698039e1a9629
-
Filesize
5.9MB
MD556b55e5f0c1f98c939d3bbe210cc4683
SHA18fcc92e30be4271482b814d6bc2113e232d07ce6
SHA25665ffd7002d671d517e58f0c17c078ec18971d807cd3df6d8644e3ee503293cf5
SHA512a614785a511cff19873439829b90ab929f084860a224f09a55cc120d35bf714af129170eed405138f9d5a477f0220e590c00bab982e66f0c29c1b28098776fb9
-
Filesize
5.9MB
MD52c0de3a6766dd05dd94eba3682507b33
SHA1ab953e1f03acf897637b23b1b9cdd4fbffc16047
SHA25635ff3b846c11913bf41c80cd88448feb46596204c6fd32e91ee11a8647c054b6
SHA512ab2b407047df32b57c8b8afac7aa910fa3777737417c0e13535bafb5d8f6ed53c17e193ff550dad9e0d02453e2be21ba86b6af1b74bef94b952a5c6feaa3ce4a
-
Filesize
5.9MB
MD5212b38c6bbb6eacb39df0c1bf13b55d0
SHA1ac6d4861eb4ea1040638e34db54b431d44281e4d
SHA256f891b1b268ad41e0fb3607e909bee04e6be6c81258cef635b0ee5e5bfbd4cc8c
SHA51268467d8d2a7af9460f6f3d4d2462ee238fcf516a9e45253571b69f19ea5f34c2e06a3e95814390ec9e9d2f87afad3322b9d693e7f3a39ed19eb0dbfe6299a655
-
Filesize
5.9MB
MD5386e21ed08ad6ea65e0c4fd0d71bcc89
SHA1ff40c78b6a9a4b10583ae73584d0b1df5b07eec3
SHA256244027ae4859d906ac9b6a7ba1816d4b543c0b319d76df8bf16e6d0c826fc246
SHA5126375c58301c18b3ae23a22b6793f2d0745feee06107769f0fcbdaa1c7c436cddd8df96ac637af810a87f76d7150d7c77510abb71c34fca0f419cf23f41f9ab4a
-
Filesize
5.9MB
MD548c08412a84c439194515dd3e800b2ca
SHA1aaec3de3bc519b1265f05d4bbd972098d4c5a0cb
SHA256233adfae46f0b3ed2b2d160f164056781be18f8a780e5f62f4f7b3520837780e
SHA5124bad19dad39d849efb2ea38a0cdd9afa09b10298db6dc19dcc7a5014652ef99d44205c145cf6abb601e415b5774ae112c7afadc76106b9d431d4a36688a7521e
-
Filesize
5.9MB
MD5eb6920c560d0ade2a115d34015efd85a
SHA1c7bebe4f7a236d2918862d4203909ef26a5192ed
SHA2569b0a3ceff7fbfcf526ff741f87897a0456d347969da27b6169b1a4bb644cdf44
SHA5128889c72a6bac557523d5194add122595ecf8ed928f91ef51d91c82f73186de1e588ceee7814a3cf87f13f268a06418111988c40d166f572c346cd2f3e3d43aa6
-
Filesize
5.9MB
MD5cca4361e561f3313ad8df4125c1cc024
SHA1e81748e430f0ec6d95ae3d5041a74439b19ec17a
SHA256d6054165207a82e1e118364843594b500497315f542fe8ac774a4caad04cf8fd
SHA51299bd04ffa3a4818c73f74e5a80156ff6b0cacb1fbc9565ac001a428cb1ac8a03a27d227748fb7ca6e61c46438e9fa863a1a382f3319e27634e30b58f6ff94f7f
-
Filesize
5.9MB
MD562d06c8678afb4ea9aaab3dadc931aab
SHA172bb386cf5d8b08818ad86990270993fba410314
SHA256668ee1ce76eda9d3dc5a1439266b747101766b11f901bf9a7bbba118ff312018
SHA5120d851eee759aac7ec4a2ced78ce56e02c1ca72df5562478ef6fc7b96d6aa3d97835400a131076d4e4ca93394cef60fa2870ddd3aa523fbed438f2175865d8ab1
-
Filesize
5.9MB
MD549054d0cb25c2173cde387aa2d876d11
SHA198e1ddba9d996b3de8c7388c0c3e4d029b777b72
SHA256de39a2d3f0667d8830aecc1fe1caa364947ed49d254c99970cf3b3d58cc1d684
SHA5123da48309b48e7b8daf6d22c5c978dd3f3201981b8b0e9d14f65a66f271e677fb3ad0377ad078521105c7f86feb2fb905cce3599a2492ecd488d1fb30d77f0116
-
Filesize
5.9MB
MD552ae4b6dd4f8e570ea9d5345e4267a6e
SHA1b075bfa919cdffbeb4d45f8ebd3473745c90a548
SHA2567ca9bd19daa28e9bd57bf4bb54d250951c47f98dcc6307f715e8d09c3151412b
SHA5121748f24256ac7a32d55ebfa069231d400e4c2c6fcfc4f571cdc0f95d88f8c43ee55b2e8191568bc9f120a78addaeb2bc2a4ad8c6d7e829641902dececb6257b5
-
Filesize
5.9MB
MD58f512e81b951b00f5d246f9eb81fba84
SHA1300e494ab3115d80bc2fdfe4707af1ba8758c664
SHA2567c7843c264b6f24eb55c4ff51a526f76bcb35f99867363737fc7c15fb921613e
SHA51299d584ed25c20962c55f43918d8762c884d85b0c5790883d965fb91c362254b3a50876a93594c73124a0ade70bf86aba969317b22736f0c7445e333fb1c7ed44
-
Filesize
5.9MB
MD511f4e2b53f1dfe769e7f36003192a29e
SHA15e0f986ec279b1d73574a17ac55ef3ff18008561
SHA25633d920e7191edd3144c4c9577a3e4a900acc84dc10d2082c71deabfae3f225d4
SHA512b7c695f497a42de00c0ac5ddc69cfaa09a9ea24da0805fbb96d76151ac508a0b32b01ab2871844ea0d162673e8a768ef948513f86f7f320fb0eeeb24555855af
-
Filesize
5.9MB
MD50d5458fca48281934eb0de0bd2169055
SHA1325f8cfa7aafaa73df5556396678be3b85d71239
SHA25698949dd6858e7ccb9b4000ec5fa87eaca36f93ec523966763feb1de815930e70
SHA5123d3424bf58d8748d7222a10bdee2d9aef0f12b19718130b3027b461730791035480135ffaffe776b98b30cfe3c19d6227397864e136ca149098caa163364d139
-
Filesize
5.9MB
MD5199e82d3ecee840e5b1e24aa1d4a65de
SHA110e001f84a72fe011dda92edda7cda3705c26cd3
SHA2568c5ed86738e2ad230990ea632129646c574e066d629116f86dfa5d48c638a8c1
SHA5129726cd954e8c8eab48ff6f0cf63af159b0e11180b15795b561abc93996c111896bb404bd1f9a534f84e62aace8d769024103054f67fa8de6d98ebc5abfa73b5d
-
Filesize
5.9MB
MD5ccf2072afdd666349c7a5470951a86e0
SHA109d5c9be7ee46c59da268a78f2c6bb797310a98e
SHA25612a9a2b4d87bd776011cc6d58da190b5656cd09b0ca448a7cd7dba3881de5ec6
SHA5128eee66b2560aa52bc0dc3b793ef9bbdb6f63874ad6ab2c4990ca6afcbb03b6b651d2a18de7cd3a57a48bb7faa6482958b1e833c3eed22f9a6b4e6df30b7300a4
-
Filesize
5.9MB
MD59f135d16b62bc068c7c1cb82f8e80740
SHA17b18ced1bb904cceb18e65e3557b7d8d18b24774
SHA256d48ad0d1a570d6707c0a44260fbae8b6fb06aed7d810e57c1f214fe46f4b919f
SHA51218489db84b19111f0d8db5c28e614b9aa2e92bdb37c998bd7ac429a3c076f139af16858ed6fe1ad981f6ccdab2e19c1806c0af83435d18ebbfc32c140bbd353d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB