Resubmissions
20-10-2024 19:07
241020-xsskxaxakn 1016-09-2024 21:47
240916-1nhrpa1fpr 1016-09-2024 21:33
240916-1ejyds1bqk 10Analysis
-
max time kernel
135s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-10-2024 19:07
General
-
Target
38a6bcbd35708a03a4bd104b84264b8b.exe
-
Size
5.2MB
-
MD5
38a6bcbd35708a03a4bd104b84264b8b
-
SHA1
30777981ea899ab92e5c2a06e378ae3be19ebde7
-
SHA256
783161abb0cd5a55fc64cd158073fe5c654804aee5509552bed6e859525bb6a5
-
SHA512
fc1585cd1aa1412ad4525aaf9d6fda9c95e18c7bdc1cdf1e01b4d446fc8677dedb65a982f5d8ffb87b618b229b41850462b4fec8ebe8cde697e6b463a496c536
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 57 IoCs
-
Suspicious use of SendNotifyMessage 57 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38a6bcbd35708a03a4bd104b84264b8b.exe"C:\Users\Admin\AppData\Local\Temp\38a6bcbd35708a03a4bd104b84264b8b.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GoqfIak.exeC:\Windows\System\GoqfIak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sudpDrx.exeC:\Windows\System\sudpDrx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRdzhko.exeC:\Windows\System\eRdzhko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VmYkLFS.exeC:\Windows\System\VmYkLFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OiKhOWb.exeC:\Windows\System\OiKhOWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EwVZFdx.exeC:\Windows\System\EwVZFdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vbwkiip.exeC:\Windows\System\vbwkiip.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEncUgh.exeC:\Windows\System\gEncUgh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKWvgSH.exeC:\Windows\System\pKWvgSH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWjxGFi.exeC:\Windows\System\vWjxGFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLdlcPm.exeC:\Windows\System\aLdlcPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DmQZQKJ.exeC:\Windows\System\DmQZQKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcwRheL.exeC:\Windows\System\HcwRheL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nYvzZXp.exeC:\Windows\System\nYvzZXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INvMtab.exeC:\Windows\System\INvMtab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxHRhQj.exeC:\Windows\System\VxHRhQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cCLyxVb.exeC:\Windows\System\cCLyxVb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYmlgpL.exeC:\Windows\System\dYmlgpL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vnrqFwC.exeC:\Windows\System\vnrqFwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\svETEOx.exeC:\Windows\System\svETEOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjWKRVD.exeC:\Windows\System\OjWKRVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d6888c6aa1ba7e220b3ee4422b4fd3ca
SHA17af097c3a00c8338cc9ce65dc053a947a11427a1
SHA256959646c74c77bb487dd5726ad0e1d621fd50817430683beb519257f08f3ab341
SHA512317daac036f5d69ca012b937876cbafda8f0a7507925e0d0b2c786b3d22da19c35d9cfbdc096840ac5152bf80ae555d839df6e310a2da8b86e445e6b70626838
-
Filesize
5.2MB
MD5ad74731de56a5bbf2073d6d541843a24
SHA117f470330c2a884b5bcc15bd444603bbe3f7181d
SHA2568cb8b2008e6ff3c9ba803d0687f30d7d209b70eae65b2c9ba7345bc0d677f417
SHA5125438ed772022b1e16e3595410926edd4afa89719df25fa06f54ff1b3037a96217669c054dd2bf4ad98e6a4117c0455373c01607973d1f4dbd071ce138dcc5947
-
Filesize
5.2MB
MD5d4f50eff1c51c089c4d9842d9bce5d93
SHA126679121b2ebb5a216b9fd703e9729b9a64bbc0e
SHA2564641aea94c88b7efaed0a9357ea8c89a3e5063489f3e47e7c98494e6c50ce3df
SHA512992740d3eeac732e3a11785fea0355f96d33e5f297161fe2bde1d2365cba1f647d8d27961fabaf0ee9d8c3f806817e2d9bc41156b820e7a4e421a1ff430630b3
-
Filesize
5.2MB
MD52c69d7217d5e84fca6683a7cbdc29828
SHA1d25121b47b7475082c04997148c7f326cad07dd1
SHA256c3d4fb9464d72d365c3c92072a2a8d70c998e6e5bc34cbbe04686787173f4c40
SHA51268c31396b417606576c04e665e313da61ed6c4f60987d971cb32da5b90a327c1548ecaeb5241096dc4bc4bee2d76fad41be7a959daf6d0590459e904bc4c89a2
-
Filesize
5.2MB
MD5ec99a202bfccf76b6ed15222c818facc
SHA1fac08fe2df1b849b1931226acf4fcc3a502ca393
SHA256d1bb4b0e814b060dae89b8f8f05084e0a297dac9d01566498ef6697bc0a8f592
SHA5124c63c92037ddd74e92bed35d53db8fc457b967b4d7cff27bb8d17efb9f82bbe069aa3bd8b933ad253cc9347c73781ec4400c10ae72358df8cb9b55d3782b5f43
-
Filesize
5.2MB
MD51b97008cfd2dd1d973a48117276a28c3
SHA164ac06119df7b01a72ec453f2aef8504e621289a
SHA2564f991db6bc03575d48db0ea9d5a4e635d0793ccc4899fa591095333ed07bb5e2
SHA5122f72ee6c5aaa22d38a0ab84b188f934ecb97320c06dc7469825b73a01c5617904b953460d4bd7e9515e155ee880761def1455da8961a8bdceb975f0019b72467
-
Filesize
5.2MB
MD5673384ef7a99341a37703e47d1609eb5
SHA14b24d1058e1e8358f85d7e067ca4aee27461bae5
SHA256a1d7da892a43b3813522de2ce8375949bfc781564077abdedc26bae25ef5767c
SHA512fdf4dccc196d2838f5a50119ab9fc0d7dd59a6153774d74ee306a28beba0fa78c9ebe84430ce551813437d5d7be6e1ed1437e1b972a3109f57a4f4770d7c0645
-
Filesize
5.2MB
MD501c11f5413caa39a8d89b922e7ef3123
SHA1bb5f030a8d13e3c08cc4f4bbe4dbcf1fb35bd8eb
SHA2565a061577f8db2367401cffda094b6c2397ef22621ed09094c279acaf66d90c0d
SHA512bd60b301a6aeb5b33f8f832d11be44a5c5a4eebc74a4fd7e24320414e3b7b668a1d6028c51b8274f5e968c3b43f029053546e176bcb23c6356110becfb457eef
-
Filesize
5.2MB
MD5379cec223d15bc01f29989d5e14d30e9
SHA17010dcfc89e4dae66bfbbbb902433426e9acab18
SHA25605c61c106addfa843496ce279a8183e1ad80b8ffefca05c8b012018ab9d31e03
SHA512f22ff842177fbc42fe4b54ff76cbcb067332e21deef98ddf1d3fa7d765178a03e22707eb30916f3f73ade96594e514d03e5fa81ac8da0e1dcaa6606f88b1c6a9
-
Filesize
5.2MB
MD5c030514b9d22641af4957a7c28e30ddf
SHA1d3ff4d6c0654d2c75a20f2523125e2f87350d022
SHA256cf0d57b5f31e80767e17051b7a147614a4b6540be956326beca3a6595c6ea6ae
SHA5129d68fe68e1adca9da34b5415354de6f69c7edabe58ca18dacec5887c04578ba6f49921c0aafc5f85518911aaaab22bdcb440c21b9cb9fc6bcc2b252589c5b6f1
-
Filesize
5.2MB
MD5677c557ae39a67bacb3ec16e0e52f1a9
SHA1162853aed715898e554a95987ad507f989e21157
SHA2568a6a19d5bf964395bbd888273596e3b4b641ee0e13f4f213501e97c324b84e45
SHA512b1b787f49287b37b864e3f0ac64685e0bf5f782a02a020a85bb56324346c17d438f78c15dc9c56da3f356947afd2ee3a8caddfeb63aa9d1f829a8f7f5110eaf9
-
Filesize
5.2MB
MD569b5ae0307155adbda55b48e3a47df05
SHA1c2a555b93a9fda41d014086a37d7e61e2149cfd8
SHA2568fe5bf800fc061e79cb60f7188a1552fc74aad46ad2601026f2eded279ded16a
SHA5128390c4f6a03d86b9d38ce5e7de6cf63efd49e33846659cce737490b0274e28dd18b2e1ecae61b4f2c6f9da0d0a609ad10d399743b47e855bf4714265d48c26bd
-
Filesize
5.2MB
MD56b80a5d8b6ed3b42e8e1f793ada1b7e6
SHA15653520ee0dbc907d332e21d94b00daf3a2f532a
SHA256927edc74e756927674bf84820b8bf83101dcfbdd06aceefa8874e88ed836f108
SHA512f5ecee5ad20550d61f559934100d52ff800e2ce65128cd503d2438b3de589d35ed58767e4498fc8096062c8e9b8374bd4b766ce2aaa4ef0080b69385646b9a0a
-
Filesize
5.2MB
MD5195b2ed219cdf512e46163739bb045ae
SHA1f9087dd2a11930313a39e9d360c971a1cfecd4bc
SHA256c0466e96baea75cc98ca7e926ac3a6f876b5ca658adef4c611b90ca3bad6a7e3
SHA512f5bd2ca2be66b0835c31521271eb1adf90648e317b727519cbfb7dcb3b3c91c8794e908bd8c18ed19b6b7f57fad65dae8872e98d76136caaf9553c4cd845886e
-
Filesize
5.2MB
MD5e90724984fc9ca2c651b5180c0efede2
SHA18765ac3c4f810cd22288f4550b5242d41cf09950
SHA256e6d6edd2bb456280b8f64d6c643e7016417938546a91ee3b5a8d318486c90ca2
SHA5120cb85f422f03936319e6b1fa849317ef6f910a94940b512c49c8301bf72e6694c8366a5b135d83191df886acedd48aea57a4ceaff862a94e56814cfcd7493fce
-
Filesize
5.2MB
MD5014aad343a241d46c0a70d2fa1714126
SHA196a89084926081f1503b853c06a6a18695381213
SHA2562dfcc356ceb86602550eb686e5e932d6b0c5410f6b00e768f687fd7babf5200a
SHA512bacffb2e02f510852710967a92914d87c72af5a822296dbf4de6707604e4e665423125d33eb75273a0fddb1f15735a95540d3936059caa8a39f25d78203ff202
-
Filesize
5.2MB
MD585abeeeebcbb927941e019c734635824
SHA1ed422feed47d3f6b3a05e82b596abeac8aae25ca
SHA2562d8620dcdf6ddd2adf2c6a7c5b3f84edb34380a38fbfa98929c2718792ce6a4e
SHA512fea1e037bccb0de8ac721dfe25e641bc7c588df03b474085c823a3bed443fdf52d2604d11f0ff003de39fd69adbe446b1febbac636a32d760f029ca41bd0dd93
-
Filesize
5.2MB
MD5d4cf2531a310e38c6b61b8533e770b92
SHA1afa710adef5c3025f8d2535c11021f3de6de0b00
SHA2565d4017e3b11195f28ea0870f4a1a8dba8fffeeea6789122797d595c2664e167f
SHA512e623efabd108d8dbda9bb28839b80ec78c004081b1a59afde5f5cc8589bba18fccd432e60bb313479fc6b2e94d11ff0442f386a313a471f1241a0a349131859c
-
Filesize
5.2MB
MD5b70d7f9ca70683de0455614aa85e0681
SHA18133a56d332b5ee6930a6c0ac2b5d1e4f6464034
SHA2561b24f05842163d8f35c5e4712212fb6e996df00380ec81263e38e532da17b669
SHA512fc1734d381c15a6b13755c3d1c14c1c34cbab308737db1f83f2f8dae19e30f13591be5ea4ffe98a5e89d3f0bf08d7317cd7e91305e62625693372a232068f0ae
-
Filesize
5.2MB
MD59be512db0267ce1a116481bb634d5100
SHA10c4521b6599cd574ace9bd2a55815e5affb86f62
SHA2560ddbb6d7130e038ca55ada58185b40db43a66d9b007cab37644174fc2ac1e855
SHA51240cdbee58d73e3ea97d64b0fb1f3d1c388800d2e62b0ee177623643662eb6e3bb9a78390d65de2291a6deeed9d688fa4d7533f3419d7ef3d746d7132eb78e3c9
-
Filesize
5.2MB
MD581ba7c5359a41dcccabf9d5636947902
SHA1675a5af6aa193725e6fa01fa70c0e0d49c982b20
SHA2569157b835c852ff276b674e83788c4cd034bc1801bd309ed9d9d52920227ae4fe
SHA512944f86e17db621451c80e2eda70797628e6e5f66ba92adc75f50a4d56605f7a99a61d89010f9c999eedcbce7c1f34fcaec926c896692996747b3bb6eebff853b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB