Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 01:56
Behavioral task
behavioral1
Sample
2024-05-21_ec8f9d24cfa46452d041768cf4652409_cobalt-strike_cobaltstrike.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
2024-05-21_ec8f9d24cfa46452d041768cf4652409_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
ec8f9d24cfa46452d041768cf4652409
-
SHA1
b31c56d81174121c1f34c22fb3131faaaf854098
-
SHA256
43371cc678b7685292c9a7d4c0f86d1984ee7b753ecc4c54e500d05f95a1fc12
-
SHA512
1c3792036d372374725f51f76c15add524dcf219c2eeb7633f9606fef538d102464222470c3d773f0f0006753b7b4245183021b52a82b1e567f75b8c26c7dc3a
-
SSDEEP
98304:demTLkNdfE0pZ3656utgpPFotBER/mQ32lUB:E+v56utgpPF8u/7B
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-0-0x00007FF725070000-0x00007FF7253C4000-memory.dmp UPX -
XMRig Miner payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-0-0x00007FF725070000-0x00007FF7253C4000-memory.dmp xmrig -
Processes:
resource yara_rule behavioral2/memory/1704-0-0x00007FF725070000-0x00007FF7253C4000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_ec8f9d24cfa46452d041768cf4652409_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_ec8f9d24cfa46452d041768cf4652409_cobalt-strike_cobaltstrike.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1704-0-0x00007FF725070000-0x00007FF7253C4000-memory.dmpFilesize
3.3MB