Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
21-05-2024 01:06
General
-
Target
2024-05-21_f23605e860daf246ec214e95f5dcf553_cobalt-strike_cobaltstrike_xmrig.exe
-
Size
10.8MB
-
MD5
f23605e860daf246ec214e95f5dcf553
-
SHA1
ce34310ecb6523be0110b7f4dd41bcfada5da604
-
SHA256
0bc388e40ed41794005de25ca6a27aa6812257832ec026df423a42a37fa9965f
-
SHA512
eb5fed5e6d601bb9e7caaf0d55142e8fdb43bbb5b6bf97b0997e95402f64a2384b169759e30ec7b1adf3e0c5f8c83ee379daf8ccbb5443241107370ae2ac8be2
-
SSDEEP
196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWu1:dYXpkG6uDBuQjmrOHN
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
XMRig Miner payload 7 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 5 IoCs
-
Modifies system certificate store 2 TTPs 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_f23605e860daf246ec214e95f5dcf553_cobalt-strike_cobaltstrike_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_f23605e860daf246ec214e95f5dcf553_cobalt-strike_cobaltstrike_xmrig.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip32.dll.exeFilesize
11.1MB
MD5ce68b2a830086491a49acf606fff7e5b
SHA1b9292ba8177b2c973b197e13f773d7e9fe2d99c9
SHA256e3d92265ac3f703729282fd6f1a627d7783c53caef411d7e99452ca1298bd8ed
SHA512a8b765cb53fcc6ca527c11a8a410ebc62d722f695a2faf9c43680761883ebd51770571a9b5b5ca53ceb551a0d274c2bb78ad31f1162fc30a0f7037ae3879605a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416Filesize
230B
MD52bb0acf737d0cee5ba38da4380be0ac1
SHA1eb85afb24b7d1fd2c83a6cd307eaaf8883a573ff
SHA256e606c2a67c59933c2435d9124784dab968da60775b2a7a82759baa95a9f7beac
SHA512c8259c286a3ca823517fc8277c32bf06fb98732895794fc7f3906391a308388d55dd05ea2ce000a686fc4eaa1548c263836476e70c2e380b39092db0c803eb68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD526f2c4e710c2360309447f4bf5cdd13b
SHA12756955df7fe9c90b02cf1a9c390235b410938c9
SHA256027952f69cce456c3099e484f5c3ed09189e1f98d82818b4da6cb11b3524b461
SHA512a4b01fda0e59a0d93d167a104316b89b0bf99dfbf82ea6a2a4c761bcd3352e4b27803e4ae0e6d313c29127f5b9a2b16c900e669c1953c10814cea4fdf55936f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b625023eb6f21e8bc3f78c8ebec22c62
SHA1bf212319b46ff752d5f57a79c5ff8892a6cb45ff
SHA2569de933747c19d5d75e09a4c326a71e7b327ac5c2232d1c927aa825dc8c6aa4e7
SHA5126a64148dd32ef33d80a091b433964a771a112cfcb6da0eccdb7537ecd4e51b58dad4481cb7a553b4aa5df94e34fc0f7cdd798dff83e58d4b8ffa25ccfdcb15c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59ebae11b1736cf2f95dcac6a67c0373f
SHA19abbbf6d344fe99bf27c7d60209931ab5ebd4c16
SHA256a76e5e8f34a5e7c043ce1a2805e501d8874190b30882c30b2892b327ef545e76
SHA5122545b8eff4768fd2e03b9772669808c9cfdca0c64c965ae24dcc3313a47f62f1eff8547c115a5095b543d947b0a94e5c1929c6a542d7e2f1ba6723cb4d6a3015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD530ca8717c05f316ab22b048e64f0e802
SHA1e8d4661cd7a29a1aaaf32205d9e4a11d818d9529
SHA256f1984c9d984322ad725d63cd151a320d647f7de4480a06adf4caed27d24e1871
SHA512b2ce336bdbf77b042866f85e5e6bd1f0dc636a9250be88b5c6546bd7dab14b354568877706cc4126df06499792afd79e75a26a6b07932db31fe230d04c72edef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5eaba2aafe87545b8514f48f772175d27
SHA1a810952d43bd8a7573770436953e109addbf6c9e
SHA25625473d5ab06d857b1ce77cf2b693445ca21f9d94246b53f5dbbb02b0755eee57
SHA512e3770bafea3b2c8c65df3ef315c32ed6a4deff996d083ac0600dc6df0e43dcf5a1b903fc9342bab6b49d5cb72230bb6e82acb4032adf69115337f7fcbdd2d411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD506c68094cfac58288e2ec16b02a98673
SHA1e7e87aa328abe57fae7b232faa70b64eed57e629
SHA25645c8bd8e7088b58b49fdedd6cce1d467aba7d14948444bb6f43816a9339fa5f1
SHA512996bf63627934b27348d399a03acd434c41d73e9a49fc9ac74552cdf25a7e3ff7a180fc105466f90df4bc20e6b4fb76bc43e85ba377510ca4eefb02bc0431624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD548fced9f2f83eedc60ca3bffbed7a219
SHA181539b680c559ca118bfaa6fbd41f3dbe99c810d
SHA256bf1d358f41e1c9d6d116fc92320ff8747891e1e0055bb4b9d50e1ce05e5f49fe
SHA51275430e2a528502fabbee3ad6faa8086527b9c923e67b29a59d7009a62e1076024a2c3a52f67c5231d9920d42789edecd46936e9514bcc55483772101b9f94177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51e3dadc1f29d1299349f3bde0923e3ba
SHA156ae366c5232c62f039540bac3e96f455cc0ac70
SHA256ba916bb787a0e216c2de97d125316e8bde6471ec7482c948477c6c9ed41313b8
SHA5123558bc86d705c2fbf28a3953c1d45663bf75aba21ff2935a0bcbd67ecacadfa21bfe8939c6870853f7b290dd236ed35d8d9041674a498fc8e2007b304dc0df26
-
C:\Users\Admin\AppData\Local\Temp\Cab22A0.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar22A2.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2180-791-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2180-2191-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2180-1459-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2180-2742-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2180-0-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/2180-3639-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2180-3660-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2180-3662-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2180-3663-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2180-3664-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/2180-3665-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/2180-3667-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2180-3668-0x0000000000401000-0x0000000000A18000-memory.dmpFilesize
6.1MB