Overview

overview

10

Static

static

windows-kb...94.exe

windows7-x64

8

windows-kb...94.exe

windows10-2004-x64

10

Resubmissions

28/01/2023, 20:13

230128-yzjr1shf2x 10

12/01/2023, 16:07

230112-tk5zgsgf39 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    windows-kb890830-x64-v5.98_b56cfec6692828d2b240b0978e09fa22ddf23994.exe

  • Size

    42.2MB

  • Sample

    230112-tk5zgsgf39

  • MD5

    e4b46649d3a062a562e5c8ce5729bdd7

  • SHA1

    b56cfec6692828d2b240b0978e09fa22ddf23994

  • SHA256

    bc1462975dc1047acace72d40dc87b3baca7c2a3bf71d5f54ecaafb1bf924161

  • SHA512

    ffd062af7bab46dcee293f1fe20bff9d677f9593595e34a3e3cf5b2b79bef0283b775adea7fbddefdb020a73e68b7a143df871328231af0600fe0bc1bde6d68c

  • SSDEEP

    786432:IMXrrRLIxJpnkivyTFHltPOTT2WFbK3xXTHqFnnOOFd:IgXIpkPHltPOTTNUxXuFnf

Score
10/10
cobaltstrikexmrigbackdoordiscoveryminerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      windows-kb890830-x64-v5.98_b56cfec6692828d2b240b0978e09fa22ddf23994.exe

    • Size

      42.2MB

    • MD5

      e4b46649d3a062a562e5c8ce5729bdd7

    • SHA1

      b56cfec6692828d2b240b0978e09fa22ddf23994

    • SHA256

      bc1462975dc1047acace72d40dc87b3baca7c2a3bf71d5f54ecaafb1bf924161

    • SHA512

      ffd062af7bab46dcee293f1fe20bff9d677f9593595e34a3e3cf5b2b79bef0283b775adea7fbddefdb020a73e68b7a143df871328231af0600fe0bc1bde6d68c

    • SSDEEP

      786432:IMXrrRLIxJpnkivyTFHltPOTT2WFbK3xXTHqFnnOOFd:IgXIpkPHltPOTTNUxXuFnf

    Score
    10/10
    cobaltstrikexmrigbackdoordiscoveryminerpersistencespywarestealertrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks