Overview

overview

10

Static

static

10

2024-05-20...ke.exe

windows7-x64

10

2024-05-20...ke.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 20:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-20_47c1196fe65906870295faef8613560d_cobalt-strike_cobaltstrike.exe

  • Size

    5.3MB

  • MD5

    47c1196fe65906870295faef8613560d

  • SHA1

    805ec30c834967b67873cb1a4f43905ff7c3ac13

  • SHA256

    0cb1414aa217149ab312795430ed3056117823afe084b861b4bae1708114d58c

  • SHA512

    3cf19cb0083fdb54709e67faff23f4a54cd75fb46addf3ffc2aecfe3bfd7e9c217f168e53841c26745bd3278ae47a61cd4dcdcbdabcc2581397beb7d26d7135e

  • SSDEEP

    98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxRUu:53EnsxxDt73DdKrwapwbuu

Score
10/10
cobaltstrikexmrigbackdoorminertrojanupx

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • UPX dump on OEP (original entry point) 9 IoCs
  • XMRig Miner payload 8 IoCs
    miner
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-20_47c1196fe65906870295faef8613560d_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-20_47c1196fe65906870295faef8613560d_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll.exe
    Filesize

    5.6MB

    MD5

    73323ea208f3aac23a5a573746c4b521

    SHA1

    27a7b3512c2860e36ebca4ea9e0f0c3cf84f843e

    SHA256

    b892bc6a711235b6d5777ce6a713e0e4d6906d128124f30d99a3439d73312b9c

    SHA512

    408db1fff8a37885c56a4b486295ca3c241b6b9ba4f109c77c6fddb1f86f373dad4c31bacd262a5e331d1780ff7788b80d5d969ef4d036b416d73686d4d5655c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
    Filesize

    230B

    MD5

    c186ff296e403b91a5014ac897ee6b2c

    SHA1

    ce4a15d41ab4e4d18cda0712bd2ebbb514524bdd

    SHA256

    4564e0483c584845c46377ee1c1f0827bb3120722a0e3ed4fadc49be8def83ce

    SHA512

    3d2dab74fea769cbbcd23eacfac25d8f182c37aca8704fd647ba9b0c0cbdd4114106c924651a9c4bae93afcecf3aa891dfe54a1e2e9ea7938b33c5679be635f2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    5bed8a291e2a80f9dd4f80ccbec4e28f

    SHA1

    02b2b7177468bc49aab033dd0bfe14936f4550f2

    SHA256

    bf1fe36a2777d83c33c82471e673508d9d942d4c2c85a5b492f2ae208f22d772

    SHA512

    567b1911597d883d0cd4d686ea9a0629c6ebe9b70e588f6555ef0c2467e3a58b9f7699c8d48db4f9720fa2c83ff0acb87abd1e4716c6f46f557079bb5533e707

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    6f79893760573391cc9425a9b92949e2

    SHA1

    e525bb8d1d316fe4d9b207e757641048f320601d

    SHA256

    f080f07b9e3547368886c5f43943e7f6a49df4b392dfcc0c6a5608e1631bf37b

    SHA512

    ba1db11ed385898fc68909bac4775effb8ef5af4eeed8d0fc41a561d69483c95ba0af7a365e098ae1514597d6b44058b842c43f70cf171113e9126e4c1ec4084

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    dc6036d8c2ac4c19eed1f3b178e63f4c

    SHA1

    2b79820516722d0e45bd616c3b23b8bb0027d018

    SHA256

    4af4c3971fc39404b205e5fd7f6df38dbbc750c3afc02b45d0601a89264efa33

    SHA512

    7c5acff1825995254f47e5099becb2455995ad9484da853c39f3743fba03e2061db775f2273849c1b93cc1c45a0c0816432b994209d5c70feb05901872253271

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    d276d24c80b766962db822b0031b920b

    SHA1

    4c1a9045096ca9d5f0fb922cef64a783cb6345a6

    SHA256

    88b12485bf608721ebab35e0c1e521731a93bae81ddfe5ee809afdb7d5fafa6c

    SHA512

    462697dc6f78af341e7f3bc426e0e55f96d0311635c78d8626295718aa713feb86111b6cff26ac860106ce5e6c9dddbea56f5ac318410ef4dc751075c1ec0fb6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    13a40ef41e7b809921b43a0f31c91a0d

    SHA1

    a92239caa66d55a726fd0e8d0748bde53143709c

    SHA256

    44699f9b86df43c34a29ab479246368c36fd45a568b1b2a6cdb3579d48ce6fb4

    SHA512

    b81b995c8a38ac3f2d1592267258b179351db2574d00cf4e2222a24f3732dd052d90a8f9a6e58f03bf503c98df43d0108eea6e3839bb92b02909f6d8184c99a6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    aa54424563a758ad616848598c496091

    SHA1

    25b64fb4d4fe3abad0a07ced15263c343f05f335

    SHA256

    4535eacc5faaf984c83a0ffde0f45d181770807d698ecc8ad1435d8b06971f67

    SHA512

    e903a230e4d2c97576ca0485f74baaa0270f3ae6d445bb073bf1884865e59adc52a94360d4e7cb2d4476b4c9c5f52315b91732a4705ebc46287d9365e60aaecc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    880d07325395bf254918e47c03cd523b

    SHA1

    479000dadbd24e4ef98cd5970712377301b59529

    SHA256

    a61347e4d0f8cee028c803b26aff0c59f21fe5629d13644b9c2f4d81c2dfed32

    SHA512

    2fd10f62d33fc7730e4e00bc44a6cdd7f4e6729157134fd84c094cab3b4226d78d91cf9c469c7c9e8bb86eaa74c01c51ad7567e62df43c24f02df4eee9a7f5b0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabCEE.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarCF1.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • memory/1616-1125-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-4289-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1616-1974-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-2901-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-3769-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-1-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-1005-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-4427-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1616-4429-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1616-4428-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1616-4430-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1616-4431-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1616-4433-0x00000000045C0000-0x00000000045C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1616-4432-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1616-4435-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

    Download