Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12/06/2024, 18:33
General
-
Target
2024-06-12_56d8a404a340854d9b49c1b2a36a3905_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
56d8a404a340854d9b49c1b2a36a3905
-
SHA1
b525f3cda9bc3ef3bf3329e9cd5b68c3bafcbcc2
-
SHA256
22b3b0bfee8fb20c4d66b5f889b72b1ea4ab3d475ec1115ecb5b16dd472fd315
-
SHA512
0bfcdc06413b66ddbb9c713e79bb3edf6769240182249289d793ff5f2fce79084a4f2e3c8b18b885b5713bc86c43c658e45563d5305667f33260df4731e8b58d
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:T+856utgpPF8u/7c
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_56d8a404a340854d9b49c1b2a36a3905_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_56d8a404a340854d9b49c1b2a36a3905_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fTDtoCc.exeC:\Windows\System\fTDtoCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QoShFrf.exeC:\Windows\System\QoShFrf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMapoWR.exeC:\Windows\System\pMapoWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IpiBgVp.exeC:\Windows\System\IpiBgVp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\acVwAAu.exeC:\Windows\System\acVwAAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NSCvBax.exeC:\Windows\System\NSCvBax.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XltWRBO.exeC:\Windows\System\XltWRBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmrzcNc.exeC:\Windows\System\fmrzcNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMxhTQs.exeC:\Windows\System\QMxhTQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUdOccS.exeC:\Windows\System\pUdOccS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSZgdKH.exeC:\Windows\System\lSZgdKH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfRPJrV.exeC:\Windows\System\JfRPJrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NdMHkUQ.exeC:\Windows\System\NdMHkUQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jHuSMRR.exeC:\Windows\System\jHuSMRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zKHCZkm.exeC:\Windows\System\zKHCZkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgTVGoO.exeC:\Windows\System\kgTVGoO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPevOSp.exeC:\Windows\System\RPevOSp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGGnNwl.exeC:\Windows\System\ZGGnNwl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bUPrxda.exeC:\Windows\System\bUPrxda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZrzMAs.exeC:\Windows\System\vZrzMAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSACdna.exeC:\Windows\System\zSACdna.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5267f533f7b81071b75b04191b994450a
SHA14fab50564338f59502465813f8e6a1a2aec33d94
SHA2562456deb0a413c249f546444d073d30bbd081dfc1c5161adba5365f556476f436
SHA512811a3f80ab98f6e3738fb507f773655181ee4247b6e083d803f7012bf9a8baa6a80126c274935f7463a1b32f3a7689fb1e0e436ae0541d1d23ed8f4f320f2fd5
-
Filesize
5.9MB
MD5b38fc40033dc0be7573af040ede5eb23
SHA167163f43af9ff7372c7c19bca07e9942e0c24e5f
SHA2568f743f936c3f78fa237570ecae9bb51347825e93d9f966709d97e21931c6906b
SHA5129f24a2cd0c82357e40a208e08313d357d0e93e038d42442d404d5e5aa8d7b5c360c927d87e55f7e41a8746fdfc710c43d471b4e9417321927cbecb756776ebed
-
Filesize
5.9MB
MD51b19bf28a64dbca7f93b34a9d9db8c42
SHA1b4831633747850a7d58e87a25d780c882050b015
SHA256388e5577296815223ba1ed7225bdf3a984f193db50f28e191c993edd7c9b1cf8
SHA512461bde6a530bf894468e6613bf5cb33219cfe280c8aa0d602e5f0945ce0a3d3738ac6d08b47642200389f9a6ced51f5567aed7c773a85a8988d9419266b8aa30
-
Filesize
5.9MB
MD55adf7c9e22dbe0bc318b542f41fff1b9
SHA15cdbc3137af5f3d77cc24d9d19c1cbb5e90f1ed9
SHA256d770257a2083fb45c7321a55a9ec114598bfa86e59a4cb4755e2f5128fc8fd30
SHA512dab7fec9cb732f8c402786bba9397018bdc8c7d7a970f104918713f5e5d9cda3c3ee9c958b310eae63d26d893b9a69264b3d7cee6effe7eebd84a32db2197d06
-
Filesize
5.9MB
MD58a6e8f0ec95b5878970d10acd5c15d6a
SHA17752d4754d6599695db9e597859aeb16eed21d2c
SHA2566dcb61ab7c3be4065941f0dd34d3c1ab7ba8fe1b574c537528c94c90c20f2fe8
SHA512bcd57f3ba7a5a5cb83905e0d11fb576f7d38b2f710b95d4d117083bf28139a13e3554c125e9599309f575f5476fcd0f5c2d32631d942f03e37f3e17bbdf8465a
-
Filesize
5.9MB
MD5ef74639c7568f61a6f1918922993aab6
SHA1dc8cbac27711f9e2d8551c1c25859217d616aa8a
SHA256ea4744601144e7eb8d3282a618de6732c540cfc734a29cdf3070c0f7f9990794
SHA512c3c2ee0481cae33693df0fff6f966f541fd400383f0c94fc694c25d966f410374980166a0d3669c2dd36851306675aa9a67d47bcc3a3aae9e2b6935379d081f7
-
Filesize
5.9MB
MD5800ee57d1f86342ecb2ef086a7af97dd
SHA143c00109e9c36ede6479ed4e47b28a33b30e4e58
SHA25684fa29f2d335555d9d4bb417fd11c3a331dd57d10f4d8a119eae40900be622c5
SHA512ba90fe9ea9d4399291d03c42bf9322b59bd3498b7b18bc21d92ba7077ac7abdd381248ae49106863927a91f9223de46f161808ebe43633f86520122306ccde9f
-
Filesize
5.9MB
MD52c11b3f36dd7689ad22062511c508d40
SHA1d12495446e841852eb7cdc6b0923cc1773bf51f6
SHA256ec29552c5a9504b01fc8b15b617ea1bd88c74c40e5b704627fe71e2acabed7c0
SHA5129f817d47ea7a41dbb46705fcfcf5d3a895055cb0d056bedea1076b3d625c9d9fac28c5c6ed3845eb52736c8cd0613b4d7c9d3ca7a9ca21df08839f6fcde38fbb
-
Filesize
5.9MB
MD557fe48e161124f67d5a714c1919948da
SHA16196d46f2f8d62f8874044bed1830f43e79e568a
SHA256e37722d678a59b843e7abb2b2b388057bfea3817f5be773013b9a46984a90eb8
SHA512dc85f4157ae8296ce3d737bd12185831a9792177112b815f30211eba1d474672d18759c2b0bd69ab0b69f62e9d5c9a8a2a732228c88faa8a0580d74d9bf90b03
-
Filesize
5.9MB
MD533456c07591efd1682991eb143997f8a
SHA18ab0a3c81b35c4d1be2020663da3d692e75b5fa2
SHA2562d472391269fd1d4ca13fcb4bc24ef689702bcbcb426c14dce22f892f72f955c
SHA51218061700a426fc7160fc9ea9aea448f82edde508c1538c229d100eae378bd17f1f3acd4f4d5b891524a5f8b52298b30d5fe2d8bc4dfcddcc7267c27c0aae4e31
-
Filesize
5.9MB
MD52a80e50c84a384452dc644c896844212
SHA1fc5115b375ecabb2816c3a936a57ea02d9bcff8f
SHA256caa1c7f733e00d88858cb3f8017b534111ad985a89e7446822f4e51946ab3c1f
SHA5122ba36073af4464869e50809dbf54c8ea6e0e224c12d1336b0ed010fe31d23a530c32d53290ca2547315e7d72367f915c0bc81ab094b0b2bed564fc7f171ccf3d
-
Filesize
5.9MB
MD50978d6a556bdd772a310cc7a195293c5
SHA126022c1dc2133d4196bb23210bd040ac4b7d8c20
SHA256c7ffa6e7ba355683bd0ec04ee20fefd4ca3f72e71a64c3ce13beeddc65257226
SHA5120771aa7b957c35c9ad926caf2fbbed77fea868f7064438da11b18389e76cb897c22c4ae7fe4482a2aca92a73a155ca5a7420e68ad90511cfcf8aabcde3742e3f
-
Filesize
5.9MB
MD5b642787c6e48c36169b384eb93c5ed93
SHA1098e96230f1f330af98a35518ec589589933c177
SHA25695e8a761884b63382c9281bbb8b41a451f57556bf5eba0ee7624162bdad702f5
SHA5126723a88e843aece5b95656a4497d9d7f9a857501ef93e466a9b8cb50ae9c801ebbb04347b02f8ed1923d53dbfed17f615f147203d135bb83337cd8dbefd9097c
-
Filesize
5.9MB
MD59ab32ab057d75e0018ab762a649033eb
SHA121bcefd953e33f24a0355e3b5ce6d9c50154866c
SHA25628e024147809bb6c6b43a5e71a186cf62f40c6841ce8fbc26168183112bfd6c1
SHA512944443e86067d6bb77ea8e787a52cb8ee5d39e202644eac13dc1ba9e6620ab6cbc578118c9936c5b9388b3c52c322312938352082645e37592128388e5cbdf7f
-
Filesize
5.9MB
MD5abaeaeef30246fa8bf037cd2e5215e4a
SHA166df6ab12da7a3773ba878229fb8f9024fdb8dd5
SHA2567598d5712b3613ecb76ad47da11415a07601a7d793adb245d20a04e2646caa04
SHA512edc59a0cbf70b999e4e3872b13c3541afd20c38c3a2e8d6ff31d4894c43048078ae68503e4e69db57dcb65c5b38435c41943d3da1043b4b44c970bd125fdc1dc
-
Filesize
5.9MB
MD5568f74b5e186d1462418057f5ae2a2e2
SHA1e6c63b2c57c9716d736fa9e244606da79cce4485
SHA2567f94b4516c4e2df5cb5f212356b5e4972e551e9eb3d46185a62a60d1520f9315
SHA51263649c6fae87dc964741d356ce217327f39a780dc2f8053a906327b61061d176d6f52af2d1ef432a80518b4fadd4e5cd1518419ff63eb0656169cfdaab4f1456
-
Filesize
5.9MB
MD5e2cd30d61fb72ed4b9d8ccc5b18fc6c9
SHA13be5a734e122d3e82ae9809798e7e517546cece3
SHA2569a797f10007701c4b706afee1a85e86473bca5fe676f5b56c7f8554343de5d13
SHA512eac486046afd77d673059e808b56d382ca863b8710dcd761ef48b2b3518da0d8573ae87e6ca8b70cb5fe2d89feb798f5d35d2b6a5e9567f270c728c147a6a113
-
Filesize
5.9MB
MD53dc4f3ace05abe2efab109817bedbe83
SHA17b0637b1d431ae6a8e712b5325bec1bda0d70326
SHA256b70a6325c59cb530ed71aa30deb1dfb0f21d0439d84c15d13286745ab66f6d8e
SHA51257c6e32625d4a81aa09799f54d0fad014c2fa2f90fc47d50c6a037472019ca0af16bef0af309367a4efab327196e9a3084012776c9daeb17dd0432df1908714b
-
Filesize
5.9MB
MD5af6eb33640b06cc396fc0c7eea5a1709
SHA1a75f54b1120a6409b5a2214891591d226b5667b1
SHA256f6b36b3ae1b9f4219eb988121a3c6acb3aed3f00e98a0ea1f76cbdf5f1f06a2f
SHA51291a74f8857b6bde83765e240dc5dcf7621bfd6242519d36fddab0d474a0e35f46460cae1cb3c8776d838e498e561b512ace93b2fd54432a81e6c29fc8a240f14
-
Filesize
5.9MB
MD55dcda3112231f48dcfd8df895f786ff1
SHA1f1b6a400c10b85367ca97cee4cfac7f08c490633
SHA25699a1d7a23bc1dccf0d37ff8ce38970903b5dfe77e4009bebb1305450f580c036
SHA5124d519ef36ee548b41e6f881c085d64423d099fedb2ec6a8e3741d197511afcddb35772ccb8de223ee8fd5d96879424455b14b4b698093262180f48fe3028f421
-
Filesize
5.9MB
MD5747af65096b44562161f49a1a215b644
SHA1bf12107406f359cd34ed5c8b4930d2d1a7da729e
SHA25606cc44e5c8e7baf2f4fe10a80a72f995decb9527110d03875ea0e2858a59988a
SHA512760dc5475d922de4706be5e44aadc4e72773b6686e3b129c6470aae2ce706dfc545dfd246f3eaf99879c5018800d8eba0f8b92bfdd8079f20d13a857b0f122f1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB