Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 02:05
General
- Target 2024-03-26_fdb4a6b4e6a5a05b8c43e4d1615f2a50_cobalt-strike_cobaltstrike.exe
- Size 6.0MB
- Sample240326-chvmasee6s
- SHA256 8423737fc6d7e7f8cb1ca69cb46b309a461b3eb0b029255718db9131ed1481bc
Score
10/10
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- UPX dump on OEP (original entry point) 1 IoCs
- XMRig Miner payload 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_fdb4a6b4e6a5a05b8c43e4d1615f2a50_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_fdb4a6b4e6a5a05b8c43e4d1615f2a50_cobalt-strike_cobaltstrike.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/552-1-0x00000141EFD40000-0x00000141EFD50000-memory.dmp
memory/552-17-0x00000141EFE40000-0x00000141EFE50000-memory.dmp
memory/552-33-0x00000141F8140000-0x00000141F8141000-memory.dmp
memory/552-35-0x00000141F8170000-0x00000141F8171000-memory.dmp
memory/552-36-0x00000141F8170000-0x00000141F8171000-memory.dmp
memory/552-37-0x00000141F8280000-0x00000141F8281000-memory.dmp
memory/1224-0-0x00007FF799160000-0x00007FF7994B4000-memory.dmp