Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
11/06/2024, 00:59
General
-
Target
2024-06-11_6559d04b9bf2fafd9a442c8d2142a22a_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
6559d04b9bf2fafd9a442c8d2142a22a
-
SHA1
f565c01f71a5af87e138a93462f53d842c4180de
-
SHA256
0cea98aa56189ccc85bdb3a252b6adbe7556a6f600499826e67b487be2e1c2f1
-
SHA512
0ae4afcb4404fa40917fa2ffd67ab0277e5dd5607a52671d0092f790487af7211fc5516eae375fdf597a5006b151a7f2973048b6f844a58b0a8ad1665864dc6c
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_6559d04b9bf2fafd9a442c8d2142a22a_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_6559d04b9bf2fafd9a442c8d2142a22a_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LgFBwOH.exeC:\Windows\System\LgFBwOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzcFpdW.exeC:\Windows\System\mzcFpdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqUwOPm.exeC:\Windows\System\VqUwOPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UoymQvN.exeC:\Windows\System\UoymQvN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naSugWV.exeC:\Windows\System\naSugWV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AERFLpo.exeC:\Windows\System\AERFLpo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAegadB.exeC:\Windows\System\GAegadB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjdQsfh.exeC:\Windows\System\TjdQsfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZFwKts.exeC:\Windows\System\TZFwKts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMHEBvB.exeC:\Windows\System\AMHEBvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ksiyeng.exeC:\Windows\System\ksiyeng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPOVKxd.exeC:\Windows\System\mPOVKxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BQhdkHG.exeC:\Windows\System\BQhdkHG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmcGoDL.exeC:\Windows\System\ZmcGoDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntzEHNA.exeC:\Windows\System\ntzEHNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqmMMRL.exeC:\Windows\System\xqmMMRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjtTqNe.exeC:\Windows\System\kjtTqNe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwnyyYC.exeC:\Windows\System\XwnyyYC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evlfstM.exeC:\Windows\System\evlfstM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SExPrfv.exeC:\Windows\System\SExPrfv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fanqKkp.exeC:\Windows\System\fanqKkp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b573acf69a45499a8379e4deb57ec037
SHA1d641071785d39ca2e855aa8b360308f0450b3a07
SHA25618cdb689173925e335ae7318b4043f914cbbc6b6119f4bb755f38b73ddd45184
SHA512a67eeb124831613607ef52026fd8a703fd2efc012319f362a21ceb871e2f50cdce210e1aed4b7b4345c7ae61828e94ef54b89ee56c20ea43363bf54a6a9e7d38
-
Filesize
5.9MB
MD591b9a04f20633ee4c670a65cac351210
SHA156bf1d01e829f72a0a4e725799b2144795ebc92f
SHA256c8e97f4445e174eb45255344e71aa7c6353bb843e1839091dfe03f5026925ae3
SHA5125ba38c2b8ba1f734ed8762b75f2ca0bde7cfdb78863195a277d809abc21725935f460c1f7cc450aff90b4457c759664bfeb53c5e0231990e69aafc2319990db1
-
Filesize
5.9MB
MD57d6e4eb156d4c071150d3d4063c3f453
SHA152f1ceb6932217820eca479d9ccdc2b60c8f0a1e
SHA2560c27c20bcbb01bfc2ff90c07494e0b5b640afb6624353f55bdfa2d01a091a563
SHA5128f9261747914f091201ffed4b868fb51a242734e7f306896253e5423b97b27881af1b13eca611a2c050ebd7e42a09a0ee854785ae73b15c964c500e77cbd7297
-
Filesize
5.9MB
MD5d14005388976391c503c8c52a42f90df
SHA1cf482d30ed0b52fcf342d15c5d83d6fb0ef6d780
SHA256e1f56d5e2241abbc6e22f9d069b614ce4a9a5549cf9891c7d44de4be45c842cd
SHA5127b5f3df11bb6d9d40380ce17810c7e99cea35410eedeeceabdd1b9cfcf5e6af0a53a84e66452299e3f8526dc624fb1215f4036a4ecba8eef7f14946b3d73b16b
-
Filesize
5.9MB
MD5b968938180e4ebc4e41be39f1fb6020a
SHA152ea593f81b1fffb9fbe548056c8adaad539a690
SHA25647ba80abe416e03fb319fdbbfb0167d8d87b5de17cd18ea7d1781ec0e9d6b3a9
SHA5125ae5405977c066ee97074ddc05bfd12da2ab7f6a22cd9c7dd3d8b686ee78dffae1dd64113fdef4a67a6d02388e294022c04262b37a00028f1afa4cd8296838df
-
Filesize
5.9MB
MD510bcc8dc12684bd1a165d6178db521b3
SHA10168eabdbeb4c06fe81bc258a53f734f68aaf152
SHA25617e9f683c299b79fe8827faa9c3938579d5e440416139a150ed77e23c4b98913
SHA51230b97eaefe3e76c2750825f800af6c35720f1ef705988e5b56ae2e44274d9f73cc90c02301fb8f333b1a41726c2dd1c7858b9b17c55da7d79f9ae8cb648929f8
-
Filesize
5.9MB
MD5621a7287fd519834f1d6e37477b6c247
SHA1dd7f71f9dc7f718059f8bad8dc7ebe394746c2e1
SHA256f6b4bf0c0a0510ae88e641f145ae579bb03554d5dc6d3d99d8082a49a6c28dbc
SHA5124e5fb2514cb84d12f52d010e2a2c4204c67fcc10288a812d84bdc8bd5164fa4a751bec40bcaafc7369b79f4ef381c07d1b46562eff78dd73ac6f2fb99bf71b17
-
Filesize
5.9MB
MD50b66f03c0c9cd71bb04edf666b5a4949
SHA1caf0adceae3a3b42e50f997af79343ef86ce9482
SHA256ccd83fd17970bb9a2e4a9f55724e2897b14399c613ee99595a3c85abef5df239
SHA512f93f80a84db32425f8126a415e9d49147c2cbeeca48de83b36d6ed44f974a28f57a450b65b98f538820414253fe85a2d7d6fb99c3ee31c527808c94509d4baf0
-
Filesize
5.9MB
MD59be2758d30ef4aa7fb8a0d128aba339c
SHA1e7b173d0af5253767e72ead1a85ece01c7dd2fc0
SHA25649866a819f5f81c338cfb9af9b3783983b07f56688d3109084b02b3bfc732b79
SHA5121681ca78a734d6297bf4bc0a85f825c26a1e9e197064b57c0208ab6fcacbc3adf0503c2118d3cf6eb5de0f06a31de449c1eae1f4f561a0285cbe820d33ade6ce
-
Filesize
5.9MB
MD53f1f192e1417471cac7546a48e991b1a
SHA1b506c250ed9ebf486cc29e90ac1f600488472d46
SHA256ee10fe7fe56e3269a14b2b8affacd42555099681226a08fd69d63449359e1b74
SHA5123277f00386613936cc54b739f7e85ec670d036b30f90d68af02177b1544a67b135eca1d03bdaae4ff1e656b090b42aa8bbe5e6cf8a1fb6f6f311f89a42856322
-
Filesize
5.9MB
MD586ea736bbac5b94a6b89928302cf63fe
SHA16dec4147b34e6b3dc3810b4b1be559b4064e6759
SHA256bb7f09b87ffce66d5a36eb0d9d31e2836775fe03697d70a06301157cf9a83fe8
SHA512962019364df226c0c1165bd7da0ff39f3ac9523babeabea956f415f789e26f2466d1a078db4c5a1403eb7fa98a7f69bb91a9b6d2d73bf6e669c31357e9fbc975
-
Filesize
5.9MB
MD515599a7c588016f3c3c5c216ba6473bd
SHA1bd918291d2efa0342ef49376b573dd17fd6ca23c
SHA256c73e42dba6660fede21f50171bdb6c5e4992adda4c59b5a8078e87371100e402
SHA512e3b8c8e89293b1d4abff8021b045cd62b0e8081d6daaad5dde98b1a7a729b0e40a07514895089f4fb6eff9b9c60c42e44d073636cfaf59fcff8646127c10ac90
-
Filesize
5.9MB
MD5e8383123a961e7bd9d9e7d56308ab828
SHA1e2cae326d6720de9cc5e81cb5891a1d371627ac4
SHA256a4f32d01a02a8595a31eb502acf8572c11b291205dd5a3dfb89ebcfcbf831c01
SHA512ce004f30458a4b4276a96938007fad570a29a6f5e50e53cb7f1a1c0b35a1bbd73dbf279d6fdaaf9a6c95d9057603050afc084ccd659b50b6370b034f1e1195b4
-
Filesize
5.9MB
MD51784ee0e64694181a366ad77cf299d65
SHA1f804aa2130ca32e2b3e559b0e211020cfba38581
SHA2565e9dc211116ffebb4bc0388bb460237342a5b3e2503a5d672e08f8cdc63b5ae7
SHA512d92c807dfb5a4ca09f3e50d57fd9d8476baad96a7f3c1a808fafdfad9711d898f0b4907af0080493c5d5882c0779bf718ea6e37d28e9833fd6dbf5c01bbab0be
-
Filesize
5.9MB
MD5e93c4af7de5212cf2a93b8c9e480b8d2
SHA1a8394c06903e64456a313a93c5f81ae5ef83dfb8
SHA256f295f708f259c5cb292976ffceadbd8d47bdbd63fb005d15dd5ab8b09b273bb8
SHA512687f0e8af82212c1e8d91a759fb99cb26f1d019a3090656f76a2def0a064ea7f71078b054484e783f3b824f71b04ed944fefc46171275d44ec6c807a8a1be5cc
-
Filesize
5.9MB
MD5c69afba8c9aa5c6aed8efc415bf26afa
SHA1e7ccd981edff87346ce12688cd1762599376c892
SHA256862d7bcde835aa4792c5bcc5ebf526cb5863c238f4dbc7a91d28910e36306b93
SHA512b1b82f2cf9c294f2c586f6eac5b59905259a470e2b932961f866790c48ecbbed87dc9a64efea07aa30bfc9299bf6b280100ff3a27a2f08ae5866c51070e4c77b
-
Filesize
5.9MB
MD5fd9adf25237d0035eabca354ff33215b
SHA1d9e7171b91c9104e6e3e1b9e5534637273748de3
SHA25688ce04b810f8f20144cd9d08e8e0d2c59f9a485f22633701c60f79920c6bc33d
SHA5122ee69ec774886d752e8ef6775e7944be0c40759cba2fdb0d64ae5e8e96bfd47683ee6399fd9353d629ad9c1a91490dee1d2cc0a1b9fcda4f5da6b14031a3b6d7
-
Filesize
5.9MB
MD55930ed2e08642e8436594b6b17d599a6
SHA1a62354a1521a305cd083fe3ea7f4c2aaec41a946
SHA256ddf8c4e9822a5e8ab726dccff10fcf111169c830ab3533ba1388cca460105920
SHA512673c984286007cf9ed15aa158e2a4eba182c3eef02196ce040c8136d54f240d8d6c7ce829ab1c14914f3a0c455026e6f68ca60752edb017bed70f612a47615d6
-
Filesize
5.9MB
MD5c24fc6f559172ed417c4c2aafb13d56c
SHA1d7ee820f35a6e3c76edbbe7486c0b00b24841870
SHA25672dcca7ff50612cff0508ebfba2910fd06a5c1ab260b116ae45cef60a5002d7b
SHA5129945efd9b41b347411c61429d741f1da282bddd2aee4bb66e09585d6ed0dae9f4643bb3b8f76179ff13be02c190eb5524b758d1e047fce3e45b3c26e56412cc8
-
Filesize
5.9MB
MD5148c12a5a831fba5d35d0ef1a242d93b
SHA123522201d4fbeaccd76134c2e6e807883cd7aaa7
SHA256346f83e0cea24a4af29fa3aa9c80767c02d109dfa71f16b57b8b594d3002d08c
SHA5129b4e99241bd585c2aedd130c1f0cbdef2b54e835a3bea9cb51dfbd651fa02faed9eb7146f8fc5c4850a1c8528787ab2d3e9a77cc2b9e6795f68f776d19d25bff
-
Filesize
5.9MB
MD52cfe9832a04c4f26659acb0a3a3371e5
SHA1c04f5c80c4c5a6ae4e96694b0450bbb30c439333
SHA256d62add31b9462c5e816f57eb17baf6ed9ec30fd62b979d6073a64a9788c0275e
SHA512c4bbb1f015e07298d4a03731dfc1c985ccb2d24be90b126f8e055f9b41bd1ed28a6483f2f6e75051ab9d0e8e1c24c0764f4324d9ae6088e72d072f48b99ac2e6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB