Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-05-2024 10:29
General
-
Target
2024-05-21_c7912766a959b8f4b207a465528eb394_cobalt-strike_cobaltstrike_xmrig.exe
-
Size
10.7MB
-
MD5
c7912766a959b8f4b207a465528eb394
-
SHA1
b2cb37e7d5e77a6916f509360030f73de8a0cd21
-
SHA256
96bc045f03acd5ab614adb27946a86268c6b9d7e6dc9d0a2fcbe3de74523148f
-
SHA512
fe3c0e666e6e995dbd02ad6ae6cd5e39647b1e619ee737b40b0b0c4e476f71e081d7f3e0f8f03713cbd974bc7f45ba6dc1e550c147b4e861d509e3f1915e87c5
-
SSDEEP
196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoW79:dYXpkG6uDBuQjmrOHy
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
XMRig Miner payload 7 IoCs
-
Drops desktop.ini file(s) 8 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 4 IoCs
-
Modifies system certificate store 2 TTPs 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_c7912766a959b8f4b207a465528eb394_cobalt-strike_cobaltstrike_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_c7912766a959b8f4b207a465528eb394_cobalt-strike_cobaltstrike_xmrig.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip32.dll.exeFilesize
10.9MB
MD5355a47db42a0fc7256d253dfeb215c0a
SHA19fedb4ab76d942e0c520e9b78d8001d34242b4e4
SHA25637b9508c2d4473e7a125503da327091cbef52f1d10244a823652cc06764ded62
SHA512bf7ae6a38edf46a354f5d7b160a693b329f798065e81603324c64e5f72ccc9b2e9b1de5d79c2bdb4971703b6d9ce93bff97cc4763811d832e5d87de83030eec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416Filesize
230B
MD5a91a387440a0dde3462775db598336e7
SHA176541360d4375cbed4c16b88bdc54e7a42c030af
SHA25674ab037c3e0583bf0111f692b5d61721af6038f0c7975e3d7f3c54da412f8706
SHA5120135fc9e507e5f3387544ec9a5cde64edbb430f012aeccae9148b7a84ecdec73ffab61a5699bd401631672b0faad2a2b2b8833ea2dc01768f6f97215b203f26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD505a1d71b0aa56f803f493b00ddd7deb7
SHA10bf2061c5b41024a122efcedf5946966e1929032
SHA25617d792cc7d87489d315416509b061ba3c09dcf3552fe5474aa58eefb55ba6657
SHA5122325df0b09f7dd3d880f75fea45fe0f569be076b5a6acacb2570ecc08cacf215046fe179499271e3d18f365269522db44c6cbac57a0fe13df352d9d9f7bc1cf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a923c5c80049dd56d0494511aa8df832
SHA16b7356a7ba3cf61f21c209f8b3b11414581614d9
SHA256fb1e192a88814834a3efe3df30cc675d690ba844350581767bca0c24271dc502
SHA512b16b14fd58eae2296b82116bd060a2731c08ce3eac9904b30429ee222f6907a615dda4650170fa12e67f392ef6974c5034d3d01ca2886da50c3c31d0e10cfb48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dbde94a6b2dced361e0975e967224325
SHA1aea7e7f2426c27ce9b78071edf4f95f59f6ef251
SHA2565ba6bac2e43945bb0a699e6a9589e300f312faeac452d878284fa47d300eab9d
SHA51268cfacc0c17da4d8442597dff25a8085d822f0e20b30854ba59dcc284197cd01bc9227e3b7645f9242eb48b862a7891b00104ea53f4f359c95a50468b1a3261a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57cd401d1ff3323f4150169284ee1f245
SHA198d3681927c4ed9311f2266d97adf603b1086325
SHA256be62eaaf47a4603eaea5196a2a0954bb0383f8885b5e7366ef6bfcbafa36d6fb
SHA51279368e93627bef8bc81d3fd639c991580f18d84ab7d2bbc25bf24a623897b8e4412cdd695282a251430b1815301bff69c5937ce9a9353e3b1d7a0cae5ef8c3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d19e9ccf5ca1af669be54de71c157730
SHA156b9dfdd9dfcf3bea2c377c681dbf7ac331e51af
SHA25619205d0e0435709181fe89b0da7e894f40591ba73b38c33ad4072da8af28c626
SHA5129a662c29d25bd5fd715f41246d7db882c9ac3f67f71597fa4a815b84fbaca50d111022700177cefcb6e36d9f1e460d750c3b7d583a0bf512e64429976c13fbff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fd5c137b9031530de0e17dc8babf3086
SHA10100d89a40c33c6aebdedf178cccd052298d6627
SHA256294beae116489cc4c021e96cc81e6f5b958f4cb378dcd01924ca3abcc527e266
SHA512dc126e97c57eb7a20dd9787db69053409a36e5ae98b85dc237841ca03023fa488355adad1172bfe76a7f9fc449c727e5ccd85c0cc6ea1d284b72ade8048cee3e
-
C:\Users\Admin\AppData\Local\Temp\Cab28E6.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab2A22.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar28F9.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar2A47.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2156-2419-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2156-2675-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2156-764-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2156-2079-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2156-0-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/2156-2621-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2156-2667-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2156-1447-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/2156-2677-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/2156-2680-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2156-2684-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/2156-2685-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/2156-2687-0x0000000000401000-0x0000000000A18000-memory.dmpFilesize
6.1MB
-
memory/2156-2689-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB