Overview

overview

10

Static

static

10

2024-05-21...ig.exe

windows7-x64

10

2024-05-21...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 01:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-21_f23605e860daf246ec214e95f5dcf553_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    10.8MB

  • MD5

    f23605e860daf246ec214e95f5dcf553

  • SHA1

    ce34310ecb6523be0110b7f4dd41bcfada5da604

  • SHA256

    0bc388e40ed41794005de25ca6a27aa6812257832ec026df423a42a37fa9965f

  • SHA512

    eb5fed5e6d601bb9e7caaf0d55142e8fdb43bbb5b6bf97b0997e95402f64a2384b169759e30ec7b1adf3e0c5f8c83ee379daf8ccbb5443241107370ae2ac8be2

  • SSDEEP

    196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWu1:dYXpkG6uDBuQjmrOHN

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • XMRig Miner payload 8 IoCs
    miner
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_f23605e860daf246ec214e95f5dcf553_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_f23605e860daf246ec214e95f5dcf553_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1476
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4996

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Discovery

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Exfiltration

    Command and Control

    Web Service

    1
    T1102

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7-zip32.dll
      Filesize

      11.0MB

      MD5

      838639ed56b741d340b94edbd31e5f5e

      SHA1

      af73629342c94750b18304c53b826f9ed78668fa

      SHA256

      091ff35847568fa397edb7808eb3139e040ee8f24ae549120c710c2da0f8ecbc

      SHA512

      8f744ba8e11fd7f29b26a3de51ac2dcc8287f2704bc48286c2a48d0a39b23ec9b8e583c014abacb1c6d0dfea023daa973250aacb989d513aeec0164681d42909

      Download Submit
    • memory/1476-499-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/1476-170-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/1476-266-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/1476-317-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/1476-384-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/1476-0-0x00000000001E0000-0x00000000001F0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1476-538-0x0000000000060000-0x0000000000062000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1476-543-0x00000000001F0000-0x0000000000200000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1476-545-0x0000000000401000-0x0000000000A18000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/1476-546-0x0000000005900000-0x0000000005901000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1476-547-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/1476-548-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download