Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
13-06-2024 12:25
General
-
Target
2024-06-13_10db1a2ff1aebf81b9b094e671f01a4c_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
10db1a2ff1aebf81b9b094e671f01a4c
-
SHA1
15984de7d4c800d6c3cf564bab9c0bdefec96840
-
SHA256
dba9d743d7a323673eb6d71e80ffdf19e117f8e1decb3b5bd6469004b0c6b731
-
SHA512
e810e5c81bfeb2aad0ed3b5ba52b52bcd5e96e9f6068d8e3fe747993af6604c56ab753ea90e1791e651f7f1f7d527f7e57b5eae19492fea0af7f754d54c9d294
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU9:Q+u56utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 55 IoCs
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_10db1a2ff1aebf81b9b094e671f01a4c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_10db1a2ff1aebf81b9b094e671f01a4c_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kLqspAG.exeC:\Windows\System\kLqspAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvrKbGr.exeC:\Windows\System\GvrKbGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iulQvma.exeC:\Windows\System\iulQvma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkSZbln.exeC:\Windows\System\hkSZbln.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqRQFZq.exeC:\Windows\System\dqRQFZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARYaHKy.exeC:\Windows\System\ARYaHKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yFICKqB.exeC:\Windows\System\yFICKqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRdpUeH.exeC:\Windows\System\bRdpUeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WZCUEzP.exeC:\Windows\System\WZCUEzP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dSqSNYA.exeC:\Windows\System\dSqSNYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CBLMcRv.exeC:\Windows\System\CBLMcRv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixMfKnw.exeC:\Windows\System\ixMfKnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhdFJSB.exeC:\Windows\System\yhdFJSB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrpTOwK.exeC:\Windows\System\QrpTOwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjxvxEM.exeC:\Windows\System\KjxvxEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEOoWvY.exeC:\Windows\System\eEOoWvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CemgflX.exeC:\Windows\System\CemgflX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvBuXQE.exeC:\Windows\System\LvBuXQE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lbJpFjm.exeC:\Windows\System\lbJpFjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMLDdZU.exeC:\Windows\System\wMLDdZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQEDGGL.exeC:\Windows\System\QQEDGGL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f95bcada27c8f7085190a1d7f62e545d
SHA12575e55ee405ab83a4a4d7ff8bce80ad7e0a9b8b
SHA256135f0177ee0003a1eeead8654d15de51bb474b74ff7daa1cad28912173ddc8c9
SHA5129f9eb96bd238f3e98d31784ceec3aee6054b7a98fa12439db3e3a67b467916b9345ff891a19b93c1091fe8571acb3ac4974681dc0713ef73d1e052ff42ddb4c3
-
Filesize
5.9MB
MD53cadc137c7b0774ebebd52f11c11d761
SHA149d470300b271daad537e3920482068d976d2fa0
SHA256175ea6b4689a61817acd7bf22ec340a5e625892b5c41063518fb9aa7a31a4a38
SHA512e008e0dd4a8b079a8c88df669d88129efc951f5c943e1ec5975d01ebd9071b45b2c1ec7104b313e3900392935012ccf2027efe339e34a9deac036e3af09d3cd2
-
Filesize
5.9MB
MD5765e1e7e4bc1fbe156202f7fc1df1979
SHA10a3c9cc1aaaaaaa7ac2fb4c6770bc8a1a101b8eb
SHA256568ca9341c721b31de3c3694654bf80391156a6041991001ae05519134f715be
SHA512a3f865d90482063daf6a1ae6f79ecb7737e8d09bac94f4946c93455b04b036fcbd3ce1a806cd87242e69caffdff1d8546c2f1cdc256b31c45d3cb82c977f2209
-
Filesize
5.9MB
MD5ef1fdc6b4c6f160fb47f7930442f2833
SHA18a963c94cf7f2c05de2d684d64f14ad14cf65648
SHA2568e12cc2a97eafdc854634d46fac092326549bf95e6b29032318539aaeea61642
SHA512dc79f46e37090b96c0b49b29bace6789add4b1063353727c773cbcb01db6b8d5d90135d4d912dc1bf4bb40ef9649be880e00e4269d4cb17a94bfeed38282f080
-
Filesize
5.9MB
MD58a27d50b82a17bdc40d2825d6f91ecf1
SHA1a2deffaee5e40d8c5ccf272e883e6635a68f9fa2
SHA2568913da1270a28d8853ca56e78554a60535fef69b4f9898b4691bfb367317b704
SHA512bf910ab2ddd459a2dc085d1c0e38797d5e0dedc28175ede8e15366656d9ee088ee98ed397e941d43503784c620c669e351e7f0204f565df47c80e8310e388f38
-
Filesize
5.9MB
MD5e881e910e10150ae335ae2018ac81758
SHA1d0493805abb3b09969c673c114b32ada308368ba
SHA256fc820ef0f447e9ac0e38a79d3071a104fb75c3be697dbc7d095046267d9097bf
SHA51240ad3fac50228f81815e705f7194b0c828d32eb724cd19b35155fa53304e25e28239d1be0e04ab783aabdde7e6daac6fe8caf2776a11dfc43f995fef8b0289bb
-
Filesize
5.9MB
MD5688765b8b0e4702ccb0dc0d68fc80a9e
SHA1b63dfcbdddab9d629902a49fd560a3b204267aea
SHA2568a04f85a4043b131a223401fb9731a8dc87564c4ace060f31dacd39cbed4940c
SHA51215c9247c8219da855d605f869de09cafc6469c04212e14741d024f02571c2c2274b975d4624d9351e967995ed4a190aae07e77c3c0f11e7e55ecfc493a7336ce
-
Filesize
5.9MB
MD5664271075c2b260af5748978117dd19e
SHA1c6e8d86f00dd994a390ccf790771c360d2d673cf
SHA2567cf20a98627df1666311503596f63b61adb325d45d2d361585f68a5890c76372
SHA512f932fa97f8e7529658afadc7d0ee94a0606b16dcd8bf08ef6a795f5dba9c504f1575dca550391ed00f85bc30ebe1cdfde4a860da17177aaac415d712d5d9810b
-
Filesize
5.9MB
MD52f0c9efb79a2bc61ba2fc6b151f474d9
SHA134b175736b1f73a6185ce9a27129354ee3b13402
SHA256a57702b62754baf96699460d6dddaffcba2642c10a94340614df833cfa3a28b9
SHA51203f158553394c519d08e449d29dd76eb418115987318281a48d8a0b9f94b988ab0e89e268b6e6d6142c70861aae0ccb96aefff6880397590d83e1295b1ddf83d
-
Filesize
5.9MB
MD51bf7b23648112161745f56d82b8cbfe4
SHA188e8fa38eca823000fd1b1f9ce3392aad727c11a
SHA256309d726633633c9699deda44bd836586e093467c14dda3e6f6cc60be2d97080e
SHA512a0271e087a7f9ba5de68e1e3e28c936952b3a2ec872626dce1460daedada87e46255e10e26057ab096d9ac624b775b0f295938447b78ddcd131dce263f3ef864
-
Filesize
5.9MB
MD592ff0ee7b9205beb7acdc4a858412404
SHA1dc010bedca91e93822e63a1d81df57850d6f9197
SHA2566d680418228559477a70f2198dc6bd131be36fc26ac1ea141377f40553613a2a
SHA512b0ad79c7819887fa7aab2a76c037fb2f376d214f87bc3580a64bc9acf048ad919c61c5d122e1e63fe54bf9cef40a0b46cdf5b5618ed1d548f4a4d4e018c56df2
-
Filesize
5.9MB
MD5b62eecc73e148a43a69edbd5062e9c5e
SHA1833ede705eef8d8a2dc8bf141f5a353cf741916b
SHA256831d7eca7e133770f14d8981a56a1ffdd03de728a92116b14ce51f2cfd080056
SHA5122887fb4f9a2aadfe555e4c30bec78d2344f024009e6fc43b82efc496d21ce0dd960316b3d569eaac9652ffefc9ccd790324436d833c9bb68f18421bb9df0b51d
-
Filesize
5.9MB
MD56ebe917d85e7216a13a6f29641fb1f04
SHA1fce32ad0522da91e823f8842822af605ff989fb9
SHA256f1c15ab70af17e2257f80d5ee5893179fb352de520dce3e26c940ae2dc4fd9bf
SHA512c982fa4923a0fc98d91875ec90ec03e71fa2859f4c78c249ee0584636168e31a87fcaf42bd26a0edfd1ac976230ed331ae3c1e1453f7d0487f9ab6ceeebec2df
-
Filesize
5.9MB
MD5a9e2aa563da5f35cb5c7f0565d4057f7
SHA1a7d1bb9da1cd6521fc8d2946ba77adc754f28716
SHA256a5e62a891fb9ffdee6d9a4c1baf72c5fdaa8aa4e1e8c29541a3ba4a6931800c0
SHA51297e9c3b4676f102a5eb81950cc7f001321a07fd0163f7e3fec77d47420899eeee10f3b589222607e1db95c7394682a5e0c165c5d3c073aebd2413768dd10ea91
-
Filesize
5.9MB
MD5c00941995592824e147fd8f40b8ca80f
SHA16426a28a8c336ec97abafa1cb8a6a79d123786f1
SHA2564cecef458bf35bd8411d674c3d6f4ff8ef76f489f1d1e7310d634e5c748a44da
SHA5127f52f607b6ac6f5dcb786abb8f3d5507712ad17de04c32947fddb34a00772cf68dfce322b244eb658f95852dcdaac7d8f1f3f0d090cbe9583a46193c9a6524a1
-
Filesize
5.9MB
MD5e42a02019b6eed86786cdac64e6e125f
SHA1ea842f5615e179730c93e1703c18c7eea5d2db84
SHA2568cc11eb100a3124b487a08c352a48f345aea482fa902618bdf5d6bbf2f5c144e
SHA512dcac89e5b3ca489637f3a7edc2f93029e7114f0ad10228ea2b28a14ee6e58d3a61266bedae6dfd3a36cecd3348a7b6dd1380709f72d4357bd815ff74108a80f0
-
Filesize
5.9MB
MD52ee5bceaacba67839d2370b2f46b2bf5
SHA1d6fba01d36161378b46b19e1366dbc4fa1ed62fa
SHA256b3268246f67709eac0bf0ab6b239e37db7313186cc252af2987e9eccdd5b85d5
SHA51217c25e7df47040474af123ea020dece0911180c91e244a277a107094ed2ce9a10f3c7d2a8f70bed101d0e1750d8a706d537ded55dd7e08f4a56127ab6d7c7947
-
Filesize
5.9MB
MD5e6ee36ce916d4fc0ccc3e059dba4068d
SHA1adafc038066ee816f319df0a7d2f1d74b98b1faf
SHA256a22548e82a8812d49d15a91546ba12e326b1fb1457518c73074153712afd7d55
SHA5126a42b1621cc05729e0f0502b753c0d1cd02f278215ddb10afba3c4f5ebd27381e15eca9bf23ec0589847eb48906c038ff9cb2d4d297eec72b80b3abc64fd8f4f
-
Filesize
5.9MB
MD5b533e05d5541e835ac424f080a11ef2a
SHA10d7636029e31cda5013b4694d318ae3160944501
SHA25600ea042d815f234c1a0a30ce485d123c64e1c0c977646f22eb9e3cf816054824
SHA5120db9ecce92bddb73b6886cc540ac6586fdf037598b1f34181d00c7c16bee7e43232c6ba3a2d6e25f1421596f0397038798bd29fd1b2328d4d6faaf6670283b41
-
Filesize
5.9MB
MD57d1e776905519ea65a9ecea674b4d4dd
SHA1e8839f9b00188d0cd1540f4d1f422f28bb6ed4b1
SHA2560ecd9d7858008e65b650f1649b623783c114a8defe9d81eb3bd4ca92dfd42244
SHA5124c59353b4203e239c1f25a87c20586ef332a179425ff668dbcaf71b45b4b5f28d89ff7b278489d143efde06c294c14f922c8a0540cd5f6f94012cdd51a1b2354
-
Filesize
5.9MB
MD501e1b9fea96a0ac37a49739533ca7ae5
SHA1a870e231032ba85a73868fe07d4e13164d3471a1
SHA256466b45505eb2c713aca4245bc504c3891e3405e3ed2396649ce80553831308fa
SHA5121fa885730250ebf968a41b43a4699ea47ecd0f085b4e2700262fbc7c9cf5564fda9a717c91f41eee0b616141d6f11a48e46a12e0e977cc57163a23a7e4cd67f0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB