Overview

overview

10

Static

static

10

2024-05-21...ig.exe

windows7-x64

10

2024-05-21...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 05:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-21_c1d129530d87fb97b08b0632a9f080cb_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    12.8MB

  • MD5

    c1d129530d87fb97b08b0632a9f080cb

  • SHA1

    5d0b9567dc5b4f32a308c6b33091d6a08fb1c35f

  • SHA256

    fc1432f13e331a7b24963ca2e24276aefc6c9bbfcee4370122a0e357314dfd74

  • SHA512

    82f8bc334562cba476e94ae42c51197f1cedb29791a5f75015f40741bcd1b12c16f37213fbabd680d867f33563db9a6c546c313e8d2059c940ea59dc6c83598c

  • SSDEEP

    196608:u2XrSIqtPazmgL7uDbzVXUHXUXEOZmPOEDkfsLKi:uaWIPyquDBZtmPfkfe

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • XMRig Miner payload 7 IoCs
    miner
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_c1d129530d87fb97b08b0632a9f080cb_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_c1d129530d87fb97b08b0632a9f080cb_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:3148
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1248

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Discovery

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Exfiltration

    Command and Control

    Web Service

    1
    T1102

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7-zip.dll
      Filesize

      13.0MB

      MD5

      0d9c4ac54e845012af82a3af1481ff44

      SHA1

      335f7b18543e193b9b068ce76e59f2762097c3f4

      SHA256

      6e27dba8fd2b06ea0f25c4a94521b4a157c8d1460025b1dd69b03e6dfe574ae0

      SHA512

      bceaebfaaccadb2e6ac44b8fdb5844c2607de244c46d64eefdb94b1e2be2973466aff3cbcc042a8b39a6d9b2817f491fef4918b6ea934090ba6285519a10b933

      Download Submit
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
      Filesize

      1KB

      MD5

      55540a230bdab55187a841cfe1aa1545

      SHA1

      363e4734f757bdeb89868efe94907774a327695e

      SHA256

      d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

      SHA512

      c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

      Download Submit
    • memory/3148-0-0x00000000001F0000-0x0000000000200000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3148-135-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/3148-238-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/3148-326-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/3148-411-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/3148-508-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/3148-593-0x0000000000060000-0x0000000000062000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3148-609-0x0000000000401000-0x0000000000A18000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/3148-610-0x0000000000400000-0x00000000010B2000-memory.dmp
      Filesize

      12.7MB

      Download
    • memory/3148-612-0x0000000000401000-0x0000000000A18000-memory.dmp
      Filesize

      6.1MB

      Download