Overview

overview

10

Static

static

10

2024-05-22...ig.exe

windows7-x64

10

2024-05-22...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-22_899f70d5ef318e6c2173e30cae312b74_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    11.1MB

  • MD5

    899f70d5ef318e6c2173e30cae312b74

  • SHA1

    4da4ea46e96c984b533f112235b719a1265d4903

  • SHA256

    34458cfaed3533352e08db79c36d76c29f6be7e37cd478262cf1be8286cc420d

  • SHA512

    b107071f724085d7e90ac99a89a2b512fa4ac2a63dc4cad269879ea27aaa78c52ad0db4ed0b7fbcdd42793b63509c3370524a607dbf8c52b186cfcf7b4366f83

  • SSDEEP

    196608:m2XrSIqtPazmgL7uDbzV0xpZr8o37nmPQLi7gCsLd9:maWIPyquDCzzmPfgCE

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • XMRig Miner payload 7 IoCs
    miner
  • Drops desktop.ini file(s) 10 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 9 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_899f70d5ef318e6c2173e30cae312b74_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_899f70d5ef318e6c2173e30cae312b74_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll
    Filesize

    11.3MB

    MD5

    89c835ec2abbc7738bf6e80cf78bc903

    SHA1

    aa398e8769a81d9c76a165e2ceac1e9c804e6d23

    SHA256

    9bec2b3e36fd84bbea29476533a7f54259d33cdba847ebda41899196dfb62b92

    SHA512

    b2318c47a3d550713329bb50b850b5948d642ddad27f84705bfb24fd3c1f3f15a630d74863cea0513f4b6c80f76a34e2ea9e9d09eaf4709c15e5541f3b427d20

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
    Filesize

    230B

    MD5

    625f94d7d0ed06cee37606d28453e5ff

    SHA1

    56b6405f4f965b6d5b8c58edaff06646873676a7

    SHA256

    be4a6dad5d0ea633715031edd4cb9c8196bf6638ed8c15782d62dcce97617508

    SHA512

    3ef46def8d2120e9bd61a5edd4058202162fa259139bdfaa0a14bf1726e1b20d7e7cf91aa6650a63603de20d5fa5577cf01d0bd26b1aedfe77662138909d0da4

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    bed466c8c42bb960ac586e0ba905a3e3

    SHA1

    1d1fe7b5003936a9cb78f42843bf018a9462f42a

    SHA256

    b4278623f8f242169a5a38ee36acde8e948b9222ea0d57fc92dfaefb38a128a0

    SHA512

    259dce46c5e87c81534938e0333189e5e735edce406408faa1554950cfc72d4aad19d5f0e06a116b819720092eaed5325c0e819c355932c548d1e3be5ef60004

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    6c2fe923be6def78840e46d3b0e185d2

    SHA1

    f697a431e8349b8d8bf6b02c113cb5c4a15a9e36

    SHA256

    ab45a98c4e4160e9a0d9f89ab2b6e2b4d1c98e2159c6ff50764e38cc149543cd

    SHA512

    b066c8ce51822598382ba88491f2eeb005fa096b155e9e50334b5ec6f407d4d2589f082ae92d2b523c20d03a07c2df8d7c75bb5696ac5a970c02c8f88b870dd4

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f1015532260f80d7192eb31845c08fb5

    SHA1

    5db670a52f6bee3d08313f0da2e161a0e12036c7

    SHA256

    d10ce775345f9d3f591a0f9979ce6f5dcb4e306fe88e229a507d3e651eaf3af6

    SHA512

    ee7466f95703372442796ada211395e6fc440188044453b17bfbd380b513de485844283bc5cef1f454bf73acff84f9057a9d013e60e0a1b03cc9d8784abfc708

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    7718e29be143dfa0cdacee902ec4ff23

    SHA1

    2bf9277911eff917f93fe34fc83fab768a5bbd1f

    SHA256

    bcc598208d03a71924e38004baabd0b0f042344bcc38aa275b31ac4e2604a5a2

    SHA512

    ae140a859d93c225f5a968af100ec3bf275988d0f6428f9300b41adb07ba2ca9fd6f0851443c748a1069fde4dfc3b46b9f8d885d82b69588da164697af1818be

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    757031ee44feaaa4adaf9243a0fd2799

    SHA1

    61742849394c8828784fd8ed50d9da578f768348

    SHA256

    6bd8fddca9d0145e13e95fb200741d66954566b41e743ff0915c28ce1a919c8f

    SHA512

    eae8bd410c4260e5d0988938c6f9ce07f2d99d0793a0346e169b4102281a659b0576e8c9f404352b2ecc14196da4e9dea9053244ce7baf2ab369d575de978fd2

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b1fdc3d7d739d8229578638ba71bf2bf

    SHA1

    683587cfcf88c4840e8a848fd294a09001c0f69b

    SHA256

    e04bac65dafc98212b75234a0f1e5b3c8559cdb10849a31625653c4016effeec

    SHA512

    46c2eabfd4acda45fed54daa458b42b2b8ba2474d318cfee494f25f643cc777dcfea58be17acf9e15a8f32f3f6d0d59f12ccb0d4e75d66925b3eb335743b41bc

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b3a08d2a69a3729b39dcc5010d883fcb

    SHA1

    82fef0b9f98176b0a79cdc34a21232dce6de382c

    SHA256

    a0f25ca496735a76a91a18def604b33a531989eae0c521da3f8f04942583c9fd

    SHA512

    4299bd8c72084594ed3aafcffd9e2a15d743e1aafc27edb4ba07c7c0bced9a25df3b787ad246edf0ab05374fb2fa0c0f8370de9538d5d32be175943eabb278a4

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    91653ce7d6d611e33fe42323d988ee15

    SHA1

    62921d2842ce941bae80cdabbb5876236a0c38fd

    SHA256

    f19f262a7402b27d7c809da788440a18f4d912e09bfe8b3163005ec7a9584ba0

    SHA512

    c443eb9e22e46d88e2c1330cdd320a0b1f32571a77eadc751b6ba452e7142ffda647468ec85cfdcb0d1659cbeb22a8414d8bd6b79f9b183771235cb316e6b483

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    12947e16174feef90d4120501fafbe22

    SHA1

    12e27e6cb97d01c80dc520a39d2a4c44e7a7c2ad

    SHA256

    ceacd355c46f305408ea2471f5ea2d5116fdc13c3e3664124327965b80a9e267

    SHA512

    16f3bdc7c590928f64701f250fa6cefeabf0e867fc46f711298ed09057ee1f54e13943c71b4ded034e846dec8887fc7e8489d7dcad6cbc8c072e2bae8709b5b3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Cab234B.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar236D.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit
  • memory/2132-838-0x0000000000400000-0x00000000010B2000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/2132-0-0x00000000003E0000-0x00000000003F0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2132-1579-0x0000000000400000-0x00000000010B2000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/2132-2244-0x0000000000400000-0x00000000010B2000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/2132-2723-0x0000000000400000-0x00000000010B2000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/2132-3212-0x0000000000400000-0x00000000010B2000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/2132-3249-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2132-3252-0x00000000002C0000-0x00000000002C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2132-3254-0x00000000002D0000-0x00000000003D0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2132-3257-0x00000000003D0000-0x00000000003D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2132-3258-0x00000000003F0000-0x0000000000400000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2132-3260-0x0000000000401000-0x0000000000A18000-memory.dmp
    Filesize

    6.1MB

    Download
  • memory/2132-3261-0x0000000000400000-0x00000000010B2000-memory.dmp
    Filesize

    12.7MB

    Download
  • memory/2132-3269-0x0000000000401000-0x0000000000A18000-memory.dmp
    Filesize

    6.1MB

    Download