Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
13/06/2024, 12:25
General
-
Target
2024-06-13_10db1a2ff1aebf81b9b094e671f01a4c_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
10db1a2ff1aebf81b9b094e671f01a4c
-
SHA1
15984de7d4c800d6c3cf564bab9c0bdefec96840
-
SHA256
dba9d743d7a323673eb6d71e80ffdf19e117f8e1decb3b5bd6469004b0c6b731
-
SHA512
e810e5c81bfeb2aad0ed3b5ba52b52bcd5e96e9f6068d8e3fe747993af6604c56ab753ea90e1791e651f7f1f7d527f7e57b5eae19492fea0af7f754d54c9d294
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU9:Q+u56utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_10db1a2ff1aebf81b9b094e671f01a4c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_10db1a2ff1aebf81b9b094e671f01a4c_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aNRCtYl.exeC:\Windows\System\aNRCtYl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FuKCUEY.exeC:\Windows\System\FuKCUEY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qTzbEzQ.exeC:\Windows\System\qTzbEzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcglQGW.exeC:\Windows\System\zcglQGW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zxagtly.exeC:\Windows\System\Zxagtly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lZlLRNN.exeC:\Windows\System\lZlLRNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGYGikh.exeC:\Windows\System\UGYGikh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnNtVIm.exeC:\Windows\System\XnNtVIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcTTDpJ.exeC:\Windows\System\YcTTDpJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqqklMR.exeC:\Windows\System\eqqklMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKTGPoK.exeC:\Windows\System\nKTGPoK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifZQKwo.exeC:\Windows\System\ifZQKwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fQYVtCb.exeC:\Windows\System\fQYVtCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rTYfwHC.exeC:\Windows\System\rTYfwHC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHzLvUR.exeC:\Windows\System\NHzLvUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVFUsBY.exeC:\Windows\System\vVFUsBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETNXJZZ.exeC:\Windows\System\ETNXJZZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxNnyBf.exeC:\Windows\System\MxNnyBf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euJDZfe.exeC:\Windows\System\euJDZfe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CzOSwkG.exeC:\Windows\System\CzOSwkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ikhurhF.exeC:\Windows\System\ikhurhF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b427678d9806bafde807311586306663
SHA1988e22afb36370e5a345d711f9e8473df71c24da
SHA256b33e86d1ca2a91de04b0bf11f248367972303e705f20704103e484da419e043e
SHA5129bd54c53651e06db9fcee8b7bffca11d31e03ecc32cf21ecba931d162646852d9ebe1ae3431420f441ce60a5450ce88e055cfb86a022f15e238fbc3915027443
-
Filesize
5.9MB
MD550a63bedbff296d344759acb0ff1fd94
SHA127f8237ac9aa0ba906b075c7994bd4cbe9887a5c
SHA256898ff764afb7eb5f9ac37b94b16af10eb0f4cda931cc59d7056d3fdaa321158f
SHA512b5e42d9e4d2ab57f37eb527b1e5fc3fab8e7d255626e63b9d0b7d74c6f46fd6dda330fd40e9c9cad7eae2c5e546ec907b47b513d1804b6670e9a92e2a49c61b4
-
Filesize
5.9MB
MD510d541cf355603b6373b489ee5ed7141
SHA1e691818ec8ec183e195e5cf13af5fe5a403a07cf
SHA256b2c90a0ab7dd368785eb2ecf26b9b2749d01e030a7a89c2d1e2a20543f179626
SHA512bb00d64740a3cb6808669bfe6dd2eae33b516dd700cdfbed348fc9850ea0bc87969fe223422d547d33f525c86751b11021719677a0e3810400a61c9a97a229af
-
Filesize
5.9MB
MD58db398d3fcd8229fcd20af76015f96ba
SHA109e6026140da0e8054d3768e54290731c42c7432
SHA256467bcb9ae5d1f64e0509620a216aae40bb7c332d7a51028ff4c8d76119e3a334
SHA512ce1317dc93b162a46aecfc4d3730496a635c33f24fd5a1e03ba1a8c472ccdba8467d9288e8f47a6a90d8fdee05ac00de4de63a86a380c64d052cfe94b440b4e6
-
Filesize
5.9MB
MD562ceaeea0ac0a1b2d3f850ebf0382feb
SHA1e3c3bf0bc5f5390ab2e3a19eb010fcc345f09354
SHA2567c281ef8e8147e253824beb2536f9c51a95ea56a99c1a0f3db658b514e6960ae
SHA512bac9666c1f172ab3686f9e44e72236fdca7977724c86643a31a8312ad6cf3934080831691cf78b3dbe871484f75842f792b885b0473d7ff83d021997a5ca6362
-
Filesize
5.9MB
MD58f3dfeaef896ee7877ddd2c26a835b93
SHA13cc06a02f01b2504fc5e16f4426b0d7329c7cd25
SHA2563d15500db120e130123d0a1953e02ab3eb2d04a62c11113554304db80c174230
SHA512fd4edd8a16efe8086ede7a515dd0d689be644c253be094cb9ff6e527aba84b504f5c97c4190dc43d4b52156bf0e2fe4e261b42fd5b838a011e48abcdf2941249
-
Filesize
5.9MB
MD5630bb9251e537284451c7abd74a14637
SHA149917153511ad35e01007c6a5d2493781fb04a0a
SHA256b48dec00bab8b5d299a4fe933dec07307b9dfa4b68ae84150882a5ca087ea0bb
SHA5128cc65c7220132faba92d207abe42c6912b6358afa229687e967d40c154a6e57e801ed4895d4599d638be7a2ddf8e4595ee9e4c99045a7ac8fa060c4526acacbf
-
Filesize
5.9MB
MD56098408dc8067c23670bed9c46621038
SHA13ed31faf94153112e505b7272d3fb81e77b50694
SHA25693fcd7196cef412b0ab0a94582e7c7e63041e1cd34ef758b4171e109dec800a4
SHA512ed1e3b06d2234431c66e02adb7cc39bf1665024bae894c3abd2b8620b86ef67ee4cbb7214d6fef2159af5401e9cfbcc93f31982ea9020645034fc5b394d15c85
-
Filesize
5.9MB
MD5059d0a20893c7678f5cf08a1aff8af2f
SHA1b9ab5ee99e979dcdeb135c1b2ef2eadbfcdea94f
SHA256294357f9a98b59d5f119d0ce1a371ea59a688cca5480c8fc5db9123006ff30c8
SHA5125fef1ab60b605f3e7d89f72a90c901317c0944998cb03b5f562ba59aa85dbfa1ad45aa75534bb300a47125a8d7c7ee0640adcc6ef36d63557075e83598830829
-
Filesize
5.9MB
MD59ca3440e7c856dba560c3be77fa9d0e6
SHA17d3e96d9eab8fd36851530f68a71e59e24c6bb40
SHA2567c0bccdb1d92322e7b4b139f7c286ce75609d2cbf12deb5c6e54fad441d49e25
SHA5128f97829e8eb471f079a26799cbb7f6c1c04649614f9a4e594c8c0aa6b47ba077908ab3bf857918fc7b8badc89872288edf8b950e0bc070164eae8bb81dcc5018
-
Filesize
5.9MB
MD5bebe74e6764ba79332c2c39c7525d370
SHA1e3ba0162516caa7ae3c864b1c39aba2a7e4e04e5
SHA2566712061651ff65da71f17ea075f756da9085eeffc7d9e37f18fc0da2dc23b7ad
SHA512f2b21023f98af3518ec86af30b5ee39974118154bf4fa355cd147c874efd92d2502542b067dca5d3e3e8e7d8775ab5a29132899436367b2b833abf27fc9a1615
-
Filesize
5.9MB
MD5bb04cd127fb5db21699cc5c94b0aeb72
SHA1ffecb471f4f335c2a0fd8710805845d0c4c559e2
SHA256c88a039393003ef6a01e64fe2b26b407cd70ca51ae57998e1a62adbf58e4fd5b
SHA512b8fb4558233a8c85d83b99475679097de4028977baa3e0c542b01f265552440112222aef34bcb6fd96cde22ccaf6f040f633f7834b1e76b73cf2f2c50655fa06
-
Filesize
5.9MB
MD5d645c4c4c31f975befed9ebd9becd076
SHA18235082ea757bfef9602164a30d4aa8495791afe
SHA25631c8671b2cbd59abb86788a77cc0b4ce1a6af461b7e5296cf34663e81b5e4bd9
SHA512ba366f45e0a9eb360bbf2faf678ae8a56d2645a7bf327b2fa36ceb6714fe7311e2ca9ef437e2e9d5b5eab3592c96dde4dac4c16175cc58f56af1d9a9a612553c
-
Filesize
5.9MB
MD5a1f6d63f9af3e660ef3b076b6dc6907a
SHA1f3e706ac71fd514984b432e623a85702b2653714
SHA25671498090490e7625db3fd36bb26621229fd60cf6cc7f48b7ba62e820a0163613
SHA512dc6cbf5f2884dd58db9ad6fa3b741a81401ad83de1c442466a6d98415a1cedf03e25156e7e19deb4eaa8e0517eeb7ea4aed0814c5d205997df1c03942485c675
-
Filesize
5.9MB
MD5957295594419a52da2cc303623d223a8
SHA114cfaae7ea811413a8562074f4f4acb314e46a29
SHA256e4b50e0e53a63043c5f0d6b74d0c2aba5283d3b289009122e966fe736f7d8135
SHA512581fa7d5ab75221cb0bf223fde65888b226183f85b8f7f23b7088395c86649875d7619b5ac460054c65e33614310cd50a5ef032dac8dc8bd2cb1a860940ce48d
-
Filesize
5.9MB
MD5fb2ff7a71e0baecb8b9e4bfee5c7c961
SHA16e6246ebc7423edc18d3d2713c2599490bd24406
SHA2561538cfeb5195dab9dc9fbebb84c6dfdc60cafcdef16bd9eec2de880c88e7282f
SHA512b5177b293549f525a67296decfc9a8c53b4a9a22c9aa96c24a534b044ce69d0ec9306dbd95bebf914bacdeea8d467b848b6b9370282d28e29e2a74d0876b91ef
-
Filesize
5.9MB
MD5db42fbacd8bee3431dd769ce1c9f5ca0
SHA18d37b50eb0041652d62d2e3ad423688cd3e41656
SHA2562054ec5c7f91977efa09105c1fb79c6954d8e2592fa2a4768d33741ad1fd6573
SHA51288b5397aea39f969eeab4bb32f2eb614dc5568cf7b924caa9aab6e0ed1cebe6e9c9b06ae36e188295111c9de3f94f86393c46fc13ba601c53e7165c8648097ad
-
Filesize
5.9MB
MD57918b26d3ee4813658c457697c41dca7
SHA106cb8f4a309937e4432bb2ff495faa8fb1befda4
SHA25621f45fde25ceb8ee9cf176f62b33a8439de43a1b60bc79afc3662cdf62a5e5f1
SHA5126622b72e4a8c8ee2e37b09b40efe7343c8da9a51d92af234df58c1e21de1b791b4f8855c168460ad74e17211f5515b4af9ffdb1e802e42adbce47e6fbbc750f5
-
Filesize
5.9MB
MD546417165b48e6b2e7bb6e0238e5810f3
SHA1bba92791a4de79122b3194d0e37efc35b190173a
SHA256291923915ac2b3a36347c66d26e02623d2ed4e92dabec302b1f6339cdf25c3f0
SHA512c2d5a80c0ffa6f3bca4a2941edd70fc88e9fd8770287bfabe0a9a85ece424cde2d871f5c8bd3047a4c8cefd4d9c6259eed0b562f86341f3d24d3f8670e06ccc4
-
Filesize
5.9MB
MD506c5ab9a113028ba5d5d598b89272faf
SHA170c52f0c1c9d1daddfec749f000e03ac5e06858e
SHA256dac4487481ef82e5392fcbfe8e676a0afe1b26d1f4c044ab9009581520be2349
SHA51272af61ecdfb7eaeae1b52d28af538b7476bc708f889e0ce033eec5e2596e7e28e25f1e1c1383af8b9747915cbd39909dcd398ea475bda0b4fac4aa205fc7a0f3
-
Filesize
5.9MB
MD5ba3d534bbbe415e3dcabfe7eb7a9349d
SHA191d604692c4d540265e56a4d6b514f81b577f10a
SHA25629bbc7c701680f6b85628c29953ed0d83d305629b849813fce73cca5381f9ab9
SHA512935ec442dab68d41d0ee602804b7a9b1aebdc3ce4b87df370e938ca0bd7590c0a3d4a95444ebbf92ed6fb8af5deeab914df3f84ac5137595c3ddf2c0b8d9d9c4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB