Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-06-2024 11:07
General
-
Target
2024-06-10_35b73ecca35a7da5e3a498b246f3f7b6_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
35b73ecca35a7da5e3a498b246f3f7b6
-
SHA1
30d1ac09ae46daf08617b1c7994e00d92a4f56f5
-
SHA256
b57bb5ca23ad49f559d991a33a26f345b1c0e96898797f1e170471d64bd11f8e
-
SHA512
f956d4c025607f4f3dc2c72b4cf9cca6c581d99184258300b3d403e3b845c4bb1047f1152a4e6de949cc1b6a5206771d3543553fb7e102b7d922b15b2f8e6f21
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 63 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_35b73ecca35a7da5e3a498b246f3f7b6_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_35b73ecca35a7da5e3a498b246f3f7b6_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rgFlxTI.exeC:\Windows\System\rgFlxTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjUnwAA.exeC:\Windows\System\TjUnwAA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XcvBJBO.exeC:\Windows\System\XcvBJBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdJFOsD.exeC:\Windows\System\QdJFOsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YiHAsEr.exeC:\Windows\System\YiHAsEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVCNmyn.exeC:\Windows\System\yVCNmyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cIwmuOE.exeC:\Windows\System\cIwmuOE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fROssNf.exeC:\Windows\System\fROssNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RszohnB.exeC:\Windows\System\RszohnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsrTwdi.exeC:\Windows\System\tsrTwdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgBVRzE.exeC:\Windows\System\AgBVRzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKtvyhY.exeC:\Windows\System\hKtvyhY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OvuEcKA.exeC:\Windows\System\OvuEcKA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nTQNQzP.exeC:\Windows\System\nTQNQzP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAqGlUI.exeC:\Windows\System\PAqGlUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njNwxDr.exeC:\Windows\System\njNwxDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtTYNDS.exeC:\Windows\System\GtTYNDS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fsosfAN.exeC:\Windows\System\fsosfAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMRYzwL.exeC:\Windows\System\EMRYzwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBCADFZ.exeC:\Windows\System\tBCADFZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lIUGpuT.exeC:\Windows\System\lIUGpuT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d93abea563fcca97486e75f6846a0d50
SHA179cc6b780101b0f3ad7008dc8bfd780d94139508
SHA256a709f7057c199d667e3eecdaaaef7e2ae39584995f0b0bd246edcad80be35455
SHA5127caead3887bd4326d2ff994a7ac903dd82bb431951ec1c8f8bdf6d5d2b85c0486fa0011b689c0e21358faa64e92faff817c221fb040c3ab205ef26074a73e188
-
Filesize
5.9MB
MD54288cd293bd82a09f3967bdf5cfc55fc
SHA1177733b42ac25230a0b698c769a310466d38f39f
SHA2566e247860f9d53996d577937cd83c95e604422d188fe033652c57a0a9dc5c60c6
SHA5122fb08a26f9170a8ab8df25dbc8a6175e23705679d7c228c68ab847ee6e2b3bbbe5c6b7832be0718cd408b4a7736491ec68587c9996a4682ca2c86e2a45ec715d
-
Filesize
5.9MB
MD57bbcdc07691afa4194d075371e13e7a9
SHA11e51cabc03fc4b23f344ea5fe801aba0cee59092
SHA256100a95e990c76a5bd30f21b7ff941f2b973278dd4e20af2d6dc1565789d24de2
SHA512152e3c88e4d83a05dc4e0a374bd5bd6df889c4aed24ef7260d5711ed5b9ccaaf67a8f42e650632252e10dc67422ffd120d25b4574b1e838b656398bd1b6685c8
-
Filesize
5.9MB
MD56f0b09df801d2a35b41a5f6a5236cabf
SHA1a4a0f73b5ba4bf96952d78ae565c7ccb70862ef7
SHA2564485f58caa53b463fca547ba59b838839e1a24c951c484c391d9525640e770ef
SHA512ae8eaff57af53a304f42dc47827d509910559b80dccff697f3d95ea301599607096dbce94c8ab39c83f611c49626dcd76558a912e363e2578b2f64c33ea70332
-
Filesize
5.9MB
MD5a02251a077eaa0058f218489208687f5
SHA1c9576dc396b7aaf555dfc7daa8ddf519f6ffebd6
SHA2563f7a1cbb7a26062023af8958f3c50978bd5713a4bf704a33598c07c873c5090e
SHA512b6f737e61d4c3e319bd9ba617bc9f3aa9e521b19838bfbd961f653d9ed38bbbc3fc35024cf15ace1b93cb0254b90d03dba65bba38e367b2c8e4abfef9f8222b5
-
Filesize
5.9MB
MD53b06c1229c9f9a8bb538859c58067f9c
SHA1e4d2c5a81b92231015d580db304ceb1acb8bdb21
SHA25640f7758382062371ff1381331da24be4138c3a03a1f7530fe369484be994d743
SHA5120755cd2e3338a68c6f70c8bc502285780f3472687ce594c0956b3b1652d285c25b8a938a6a0d130c2e69148318b7e9dc92dcc3461f53a29d8838e0c0f8ea81e4
-
Filesize
5.9MB
MD551aed2620d65875d7deeee4ad81c30ab
SHA1789e47f41e82b471d66305e31553813f23673c10
SHA256ac2de0f1f9549a4ee766224ed18f3604964a127831fc3933020e68c8dc484ceb
SHA5125eec0490ddc082d786045604518a1dab13d1a598dfeed5b7d83f94308fa70c32ec83ea0140f80c7e41ee05012a56e4e9763ce4bbdc67e6c0a1abd54eda0ec4b9
-
Filesize
5.9MB
MD50f78f4631f0a333328bd0a86f0077ea3
SHA1db2da10dfbbe6a25ba9ef9263d10cd1434f2cbe5
SHA256e28d8db2deb4ce3f9ed7a79e05f7ae42e4e4cfe960349a0f793ffb5f3d68035d
SHA5120b75f572f2a2e4a5fc67a33e988243e75a0497a9d0b8e12268822151fd669e43043bd41ab2b704ac134c775e3c1c921d06f149852e46f5229fa843ebf72b30ee
-
Filesize
5.9MB
MD5e1b4e5f964abdf8a847b903f743e249d
SHA1fad0258d3f2de3337768cb2d8adec5f01bc10815
SHA25694c96aba3c933eb42efc68f3cee8c073648e51d65b2ca21385f82ed4b67759b5
SHA512868897e44dcbb3049c01782a47016b35aaa8ac45bdd0a48f1c0ca6caf8098bfc0a4c2573280ca696b9a2bae26c164bfa95e53d280fcd083f1656e9ada796de9d
-
Filesize
5.9MB
MD5bcc3a40e50acc580adf3cc485b32c97a
SHA1ac4692664e0cd4073a1e9719a9d0542a3284a6cd
SHA256e7722869b0c146aa3eaf123010f9da26b48ad56587e7330925d52fe6ff1e5d83
SHA512ec4869221408dfdaf2d6f812a65978ca920beba7a721e6d20d1517782e9ab304fe90cd76c44df31c4cbbf79cf5ceacd48da403b762b55b561d899a996ac6e313
-
Filesize
5.9MB
MD538d403780a1c001f01947672901ee863
SHA11c8388b638ed85e29eeafebe97c0ccc2790e2241
SHA2566fc2250cabcdbd36ade89e55cd8069d9cb26c1b660896c9a94246c85ad16a8a7
SHA5129d135b7c8fd78fc5c0b12a1f4a48697a8815cf0367e734789077724df638bbe0b56202778b06a954b451704e04735f4fbb34e3711e1804120607004860b3bdb6
-
Filesize
5.9MB
MD585569dbc8fdb930c69aa3017860eb0f1
SHA10eb9bd096626fc229391531d79981171a61d6702
SHA256e20095c72b37f0e6e1edaabf84b91a72772053cd8f93b00c5f86520bcc29e4a1
SHA5125ddf8b6ce2e586eb0762e2a63763864fc47231902ed6ee7a3abdfdc24e5a45631cd57d1e5032062c64ba48897085b8b16e89ea13696fc3a54f6cd77c6f9b9fdd
-
Filesize
5.9MB
MD5b67f2c33f47bed43f0a64a43b742235a
SHA103bab1326f27feef060f0d6b346e709903ce982a
SHA256e5a46404b06840abdd05cea6196bbdb72368c5773579a0e766f47f448d969fff
SHA51253d58293aefcd6aba19509e891f2adc55c96457777bdccef08f11148a86058d87462110288f1bac07e10993a6eefb776da565baf674823e8354cb3d77792b2c5
-
Filesize
5.9MB
MD5c23e52d0eb5e9499026d30732c1e9d94
SHA176edbd47e357f91a080bffff946c5c7e85cc3d26
SHA25649f719c2f28550a652bb2dc6f0136159278a3964529cb058ee25c00b4af42880
SHA5127de29fe5043ba10f943183294b0fe882da00e728de1937656ce9b9240b26847a046aa7814ebbf5671d02514c1b47e8bb9674e75d1b88bbf7ad2f63ee96066dce
-
Filesize
5.9MB
MD55927c68be4d3a452a4d8e27add659e1d
SHA16b6b8f1a8c760843561fe8b97d84dc2c6c923194
SHA2560be4e06f57f33213f8524cccd5cc08acff9799abdb1527a6425aa4ba1a95b5da
SHA512ecea6a63f65afefbcedbe434217e8bc4df927d8cc81a01d63c6fa43d3d2a5202e849d896d7c3bcd5628c3ffc4484d41a4cc9ccc15f87c6072ba3e3104924249e
-
Filesize
5.9MB
MD5c984c2dffb9215ab31268409ae6ac812
SHA1d4afcb4590a2563c4a8f75b6f3eb86ca6f10d197
SHA256c5e3cedbe9d3b6943926ad8986fe8f13636eeab0969ec08d35c7ab45e1d0b3b3
SHA512dbfeead86c6d56b76b0d03661d4c35308f315d9292839548cb43a742fad89f02fe2e1c1c4d05d1187100f61b17100b9382f50ae486e16138f97bb556daf1a5db
-
Filesize
5.9MB
MD5829173ebd6cd5c03d4903e4b601630cc
SHA1d3bc1dd0e2ddc9708003acac4093dd9c874dd200
SHA2565c4c14989982ea11006896fc0bcf2321c79f6b0cb8acf4d0d70c5ae91e66f23f
SHA512fd94c8432677e20823f709847b507c71179ff5f584b6cda7c4fd57106ba17481fc3c7ae9bd4a90561b3e4b1e6af1cd8d30a3d0d78d3c48b445862890027a61b5
-
Filesize
5.9MB
MD5cf232c8379562b460e2a2966d1083843
SHA168e9fbe46ab64b7f4a55e3484fc77c3f6f1c5f99
SHA2561e1d6573cbac1db1db2d09fdc68b186a750f0e4e43c2dc715589b151a9068bdd
SHA51252b64065d51fad3b3875e0da8a6918eed1f66cd17eff290495e38ec54f347e21d6661a2866da72512f5a29f413145f48e6b17ea3276406d1c8ce8c20260808ad
-
Filesize
5.9MB
MD5115d6c13c756b763c2f94505d4fda426
SHA1bab0abf4a389952a315c15f78947a64f9cd28c00
SHA2563f46aec0ff45982afbf9e906eaf782fd75b332774c719f117f44ef4090b5fea8
SHA512f9c7be2df762e501230041ec25f860fb8cdcc16d11c6311aafda1c89b02a3458d6c86003aef607dbd473b396c30ed9a490c27da073fff8cbf81a0e60fba3af29
-
Filesize
5.9MB
MD533b6a3d8b0f7fb5a214926e2a042397a
SHA137ec1614652e81bce7d77427aa23dca933adf482
SHA256fd40e6fb5d0ab40e3442bbf7b291df3708623e87e2fec7cf14de6d79adb667a3
SHA5121684e995b2ac9786eb51f9ff7a525ef9c7d80c841b0b4d316fd5bf986eca711f9cf9c07a14e001dcb8a72a1ea1089ac2673970137e74d37728bbaf89a27658db
-
Filesize
5.9MB
MD551803d0a9144d534ad6dea8d43a8de61
SHA1b246c40751d39f2b8b31e63a24c826c00a3e60d7
SHA25696910ba66326bb6e47b543b20acb15f1acbeb57256c7a509a0685052309bc5ca
SHA51200a0f76539b14e1597f62cbeb39e72f892ffd79e12da9eca4b2fca6826eedfc640ab9be801f264c443bc9575a8a6b410c21c25c5174a885d3aea461347577649
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB