Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
12-06-2024 14:20
General
-
Target
2024-06-12_e1e276e368b80806d7a7df6a406205d4_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
e1e276e368b80806d7a7df6a406205d4
-
SHA1
0e0c2b53161d75e182dce6415abb81e0ba829a82
-
SHA256
f0abbcbe563766625aeab5488774b5bb19c425d758a75b9969a7478a06379c62
-
SHA512
19db29e6e5f793fe32e858255cea1fce33f0f8522fcf5219e7178b28e2a7576006b133e3fb4542633533f15032ecaf42e680e8d40f0bae4783d0371e1303a2db
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 54 IoCs
-
XMRig Miner payload 62 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_e1e276e368b80806d7a7df6a406205d4_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_e1e276e368b80806d7a7df6a406205d4_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JDEeJGd.exeC:\Windows\System\JDEeJGd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQzaAiu.exeC:\Windows\System\DQzaAiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kpFwBeB.exeC:\Windows\System\kpFwBeB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnmKIAP.exeC:\Windows\System\LnmKIAP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyViuGx.exeC:\Windows\System\gyViuGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFBfdQp.exeC:\Windows\System\DFBfdQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INiRFOi.exeC:\Windows\System\INiRFOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuNBeLW.exeC:\Windows\System\fuNBeLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXBFatN.exeC:\Windows\System\cXBFatN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMAGpdD.exeC:\Windows\System\MMAGpdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnvjJsP.exeC:\Windows\System\TnvjJsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UTegQrT.exeC:\Windows\System\UTegQrT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axnzipA.exeC:\Windows\System\axnzipA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YOxhOaA.exeC:\Windows\System\YOxhOaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bQiDPWv.exeC:\Windows\System\bQiDPWv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gYBWYzD.exeC:\Windows\System\gYBWYzD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NsGnhns.exeC:\Windows\System\NsGnhns.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnVXDUX.exeC:\Windows\System\UnVXDUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ESLmaqT.exeC:\Windows\System\ESLmaqT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKqDmnf.exeC:\Windows\System\EKqDmnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JdStPDJ.exeC:\Windows\System\JdStPDJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD574ea50329298ee9b2c31d30054f958d5
SHA1402b388a98c7f70b6567bab8386d90d5a7476cb1
SHA256affdde050ae63770758829bf941edfd8f9a2421c1211272b29c555f6fc4bef13
SHA51201c0dc9af208242ffaf1cb3d387fcd4a7ba5a99ea406092c15457283be1641d7be4092a256557ad08561bcd0d144235079664ad6ed67617803f53b1cf1f213b8
-
Filesize
5.9MB
MD5cfc7cf67b434c6a67ef15a27f77f0fc7
SHA1a870b562f4648b8f2f65f70ee381f050577b2cdc
SHA25667d4b035c37089118712c67e2f8947abd0a31fad93b4084f89e4ef36be441f65
SHA5127d5b6a09dd5fc379395fdeb9f9eee0ba216f7d2d729f5563ff8f3c3067c0acd75ddd1c3bad06449a089370b2d601f43f25f211f092fcc9bc6abca3dd8ef54e6e
-
Filesize
5.9MB
MD5403007a9092349ea6c2d4ab19b45710b
SHA1b1c3a3d1f842b35d84367393964e0d058cb8d1c6
SHA2568dd906d4e265494cb9a75cec99fd281e0617decbfea1ee9093aee4d23850c5f9
SHA5126359838c1ea101f1e1fda9e197f280951d26ab2d380f0703a4ddddd4ace69e879f11b5a58fe99b2e4d2f40f8fa20ad8a63d2ad89a696b77418df45bcb76f28a9
-
Filesize
5.9MB
MD5bdf7d06f8667b89284cae21677ede71a
SHA10f1b21b438b3f46b633669dcf31c3626d790a502
SHA256cf2ac880a59c40ba604c38d7ad03a3251531d6e591affc666a213f4f687ee768
SHA512d930c37cd9c325fd8189c0dbad885468fa588f2f99da20de40712331d4749d9fb8a0c280ea3cda59e4c77a270a6752e2dc20558248305a8a0f4ac68ffc7b2506
-
Filesize
5.9MB
MD5f46a9bf99725fb947a4ff973a8be73ac
SHA16a5533f47d8bb60f870b1a52b2fe82ce81c3ca8f
SHA256dc3cfd0e2c4509d8a4b0bf28699fb77db39e39f363d4ba307289c424e4e7122e
SHA512c6ec2376e5277ba23db7d99ff8c474761da6b2e7ac928cbc8ec0a17fb80cb09a5b48279452d2d2fbb078ebb106f292e1410c9108f9d5fd49e4c963ec2e54663a
-
Filesize
5.9MB
MD59029d437468d906e405ace05207e5a4e
SHA182c92d976340e94ce89dc303e3ea622ae3bf8a02
SHA2565dece72a4c0ff53ae3d34f53ae8e8f5ed6523c0a78af6925ed0eb3eff8bcf061
SHA512017759fcd370aa5410c0760312ecf6a44e25a3956696adac7d267a80f110aed12e2a3bbffc9c8191db97de8e2b17cac5edc9bf875ec9b863e1b5419008df1739
-
Filesize
5.9MB
MD55495fa57cec9c5ab8621a3fd4a8df173
SHA11bcad1cf578f34ea59e47b12a0a9d8480aed141e
SHA256b160ceb999bd87fe052017a1c4e4d13738ad02af2d5c6e79d8e5cbbdd8717ff1
SHA51241203ab1702dd3251556a87e9a8ea0c109e8b25ca58148c5c9f5016b0bcbaa61d304427a32cecbfe198d8945f34ef6eb480349e6e5fc5a79ba366ca8098c96e9
-
Filesize
5.9MB
MD5df6407c27db89e02ae08bf0c4c036748
SHA13cf9709052c33d00becda3cfa1e50e4910c074c8
SHA2564f6ea66b404531a1fc01a45b8e70fc51a1f043b704e3bb680b91b6c453e11fff
SHA51201f41a1c09d212c440f71b6d9aef7582f7132b08c779e1b8923974d042c1bdc929e06ed8091e0be7b5b029376da2fd3fc3e402342cf62b79d5e61db35be22fed
-
Filesize
5.9MB
MD52b4243c021a08b7ddeac250c465621a0
SHA1a2f5023f6ea5bbf11a7ab4dbd15054ead5afeb0c
SHA256e27aa2f89e5a90abf83324459c5debacbd172ba5830bd63ecabc538125e95f91
SHA512e77e0d3de71288aca102a349ae5ea45513425ac96fb255ef63bf3e18fb2971db925fb27f09fd365ca88092fb3e4bcccad4ba3305837ef72bf55c92e6c2dee0d7
-
Filesize
5.9MB
MD55eaecf6f75ed6f3c01bea672ba314098
SHA1119386dc62332f451591aab5f51a6ff5592f8b3c
SHA256e77508b1453ff975907e2c025048b66d943f43555e1ea8e33f88271b125bbb71
SHA51293cbe2d83bd77ca708a3c9f83abc7962891ae04cd3855473755b1e2a249e84e19165ce6c6be63ace3d0b225b3a5066de9cf43b0b2e2165bfb61c0afad9fbbfd2
-
Filesize
5.9MB
MD55299af940af153e2d05c3ae1945835ab
SHA1504ddb9df6e3b24ab8a3c1beec3c8603edde923e
SHA256272a0f1c21585655907f78cfa30617763fd1336f8df77a0fc9473ea13346d3c8
SHA51278989323581df09fd145e651735bf00e1f2d4c2a106be54de1f297456ee1f663bd782f195b8bfb3e4387f94274a0c80737918f259bd2b98c0f1638cf18fab3a1
-
Filesize
5.9MB
MD58950de2fc06a67bb378fad247509f470
SHA16f4e0c91cc689f13c512cba517403c472dd6f7e9
SHA2562b64b23b3b79b370556a6cfce5b53d939782c72750d68344b1dbf478198d3fe3
SHA51204119f589a7ce164d584168977af67c2cd152054f2e0c77e4ff36a654e7a6307fd2206e696367d6750b790adf6a57dbaef1bfc5688c614ac157b1096f59eac4b
-
Filesize
5.9MB
MD50c0fc8d2e579b8a58541198de70a5e42
SHA16cb73ef749e2467d75edfbefdbad9eec1b6768b1
SHA256ba458e9cdc72230215de9661f3b0fd663b3cf590db93e42b70974cfae70c59e3
SHA512c4393767975e1bc215e03d614a3685f25c3a4c38a199fe9c92cd2b5e2c77ca0728767ebc650b6bf3a3d620519409022e18627136f5a233e57808ccabe1b851ee
-
Filesize
5.9MB
MD51ab685a0d0e74824193c57dbba6e7306
SHA13f274e7b3bea6df2c08b6a40969cff91162991d5
SHA25644c6604c4d2415dde2a519245bbd29dcb94ae31785b80cbfeb81a9ac0c18451e
SHA5123a5b8392c8949592cc781cffeaccf2694fdf711e5eb3495cf8583c4b01c8d1372f373336e7a48d65e060ce572cb87d962347c8121fe05c1d1feb1dd7ce86ed06
-
Filesize
5.9MB
MD524ae2968fcd613b459686bfc5956ff8a
SHA18c3c6db58a50be1750eb13a5d8ffe94e227ec78c
SHA2565a6931a0fe983335ddbefb37d07270e7e96be71af5ce961517df02449ab7c684
SHA51250a534f767c06b38f993c232a833e5d1a39423e9eaa1e418d357553d01a45b6b90981ada754942cb102814cb4af92ca265416e2de1d6cd819f840136e6c314d5
-
Filesize
5.9MB
MD5aedd9b8d4021e7d781601fb0da516a76
SHA133d5229258d31a2ee04456df7a0b61b3af746915
SHA256a16eb87c57bb73fced357204cdb65adf13a875e9f664ba4322d77a104eda346a
SHA5129155aec450c060c20dd07ff3e7c2ce1e634bda8ba3170f9bb61d4e924230b8d0f09a9cfbbf2f8a3730a630198783cbf82c1c80d245c54632d756ed2548d2b7b9
-
Filesize
5.9MB
MD5df89b658a08098097ee1f4f73217cfe0
SHA1766c017e2e8587e43751a347039e48e686063ad9
SHA256118514f8699f58eb0f9623abf57fa28d93c15db8ffe4f47e49900e9236e857b6
SHA512d8a1c7bdfde5cf0f93a880ad09adb2f7e911c52e4b145926851e927717e6bd01dd6dbbfafcbb7a7ca02adc1a6debf8593110ad9ee5ce0937197ccbbb59f3a38e
-
Filesize
5.9MB
MD51b27fddfc889478e9d11826224b4ffdf
SHA1ba37a10820f4a0d334073295f7bed8ad095d1503
SHA2567faca3c071b318799c4c02111c9d394a175a8a1e27ea7afae1bc37a0b65b73b3
SHA512b1a61c9db542b36d731a0bb80100897794453e82322398cee252b55b769c178bda9860f52b890bee85694639371d3e8d61c57b2baec0a48abe2d48e5d9d22e52
-
Filesize
5.9MB
MD5d99712d0ccc1ae82a66843021c89f1f2
SHA10ee2d319c88fd9f340561b16ab71df25e3b8a0d6
SHA256727bc32cb8fa898c48acd2c989866903c619ad5634e71a506b3e3526a41b4251
SHA512fad9652c3786ffde5482910b46dc923a185bda8536c7e8d52f6113f4b360edbddf27b4f3a6d904d15e8ab51ac31ea377ab0313457f0ef96ec615d6af69d8a2a2
-
Filesize
5.9MB
MD57d02361193ac7fe23f8a3b093a499e76
SHA111b5958002fddb2686597694014340d99a318c57
SHA256774a37074fbdf8169b94f1bc8a25fdb9cd8f15ba1e29eaa2ca2e47f6626cf429
SHA51200beebab15c62bdd01c1923768f33756f72b6ba64557cf8b6d7a8bc026556c13a62de7ae5b36e5a0ef6d487cb80e26a361e6e0724127c410a0ae8d9f1bb589b1
-
Filesize
5.9MB
MD5808417ba099ef18aaa859e3c1b9e0bb5
SHA1bff0b5abe413f683050f6fae6a1edb068d346af8
SHA256c63d240ead668aeefe3186fd10ac178feece52afb38196b10a82bf6f6b3569d4
SHA51275666164b58540254e7908375f9202e92c4246d7379b55aeded29105a7ad8373f89a1b66337d8a6ca90e11e4d08547584f3ba44e377e8f80db844cec6bc856b3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB