Overview

overview

10

Static

static

winprofile

windows7_x64

10

winprofile

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2

  • Size

    16KB

  • Sample

    220517-l99d7sadd2

  • MD5

    23c8b23571c065c1d8c65beb2899cc42

  • SHA1

    fd7f51575ccaeba2cd6cb0d2195e2be966c0fecf

  • SHA256

    932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2

  • SHA512

    af1df92b60d1cff475deb7688b7a8baff26feb240a0d48a9cd73df3d1a5b9acff72d353f686de259d3bd77c0df1a7f7b269434789189a26c46a02313bdb5e64c

Score
10/10
cobaltstrikexmrigbackdoorminerpersistencetrojan

Malware Config

Targets

    • Target

      932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2

    • Size

      16KB

    • MD5

      23c8b23571c065c1d8c65beb2899cc42

    • SHA1

      fd7f51575ccaeba2cd6cb0d2195e2be966c0fecf

    • SHA256

      932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2

    • SHA512

      af1df92b60d1cff475deb7688b7a8baff26feb240a0d48a9cd73df3d1a5b9acff72d353f686de259d3bd77c0df1a7f7b269434789189a26c46a02313bdb5e64c

    Score
    10/10
    xmrigminerpersistencecobaltstrikebackdoortrojan

    • CobaltStrike

      CobaltStrike.

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks