Overview

overview

10

Static

static

10

2024-05-23...ig.exe

windows7-x64

10

2024-05-23...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 02:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_beadc15a71f71f86a5cd7f1c92bbb457_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    11.1MB

  • MD5

    beadc15a71f71f86a5cd7f1c92bbb457

  • SHA1

    d1ed1de1350353d2943efe852f3b261828aed65b

  • SHA256

    671937a256d96e8771f1951a905d6001aa38c39661c3602749e2aea5233e6855

  • SHA512

    9001cefe33807307886a2bce63e3d0694dbe367bbc484c308ee0d7bea3019a598a1ba0d66ffc705834fbc9cb61f5de2856c27bbb149e75edb98cfb6e6c50107d

  • SSDEEP

    196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWMq:dYXpkG6uDBuQjmrOHc

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • XMRig Miner payload 7 IoCs
    miner
  • Drops desktop.ini file(s) 1 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_beadc15a71f71f86a5cd7f1c92bbb457_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_beadc15a71f71f86a5cd7f1c92bbb457_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll.exe
    Filesize

    11.3MB

    MD5

    5eb84a1ba3b10f0dcf4da7e97eab30e9

    SHA1

    b0dd04ac1d78d7d1271f231b161552f16ccd46e8

    SHA256

    6a09dd35db209c00d3b34a66780478f75e47004132823528b39bcf3dccf2aebb

    SHA512

    f149b782fd65070d7f47f90535bba6151916c94d521842ccf9a5d6e37c17bc8372c674c7f0b98d905e8b2761d2c352335ed47e608ee66f289c24d2cae3feff24

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
    Filesize

    230B

    MD5

    9831f3fba377f3817beb8dd2c081ab4c

    SHA1

    0985f073ba61d0728d53de734b9f46ad9b3d6f49

    SHA256

    da796af1f370e412eed19ab4236775f8a59b8a1bcbf6749d2e94987127f1be6a

    SHA512

    5901c14f6da3cd823031af6a8b185b0a928f284865efaca793b4c26ec85f3354153f09d88d8c91477cc224282f60f47f6b3f391319b0b0e3383d497d79cdf002

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    030bdc7fc23d1cf4cfddf2963b62d0b7

    SHA1

    ef023db72886f95538bd276c6d65565c1ca7ede4

    SHA256

    038ba072dc4ce6f5132d6ed7b984addb1411bacb8b63056ba7055053d3b9c713

    SHA512

    c4d3f3a7d69b4d3d6eb0340d6f4c1df69915021999246fc2bdb09e027f7ad3ba661816faaf5ddf38b1f431e432425e9fc415e0901a9cea310dd31fa9ace75809

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    816a2aaa5edd3e42e4afbf04205a6083

    SHA1

    7c646cc17d51e469ede2c62129f96ab882516212

    SHA256

    7887795b868ffe7da33b732eaf02e09565e770047d64c5af6ef7733c44acbe5c

    SHA512

    d7dc5109d376b4848d9ec121c1143f3d4d2a26763a17f6f79d8643793deaf97007a122162a9994d74b8dd252949de73dfddebdd94919f9dec1953070b6018302

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    cdbc26410be95f7d62fc6dba9f7e8072

    SHA1

    bbf31bdf6a93f80b20874c7cc3a9b7429289b0ee

    SHA256

    db910a2d3f655f8f00fba917268e9e8e27ef229fff7ac8d1139d2ad170adcdb3

    SHA512

    0cced33257377d3834554cc56483477c3b8c0f9907c161c9cd81a2505688b2e002b1784dcbb353baaa9cddeb732fde533e18a94837440fe78765b7d017cb674b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    5cff2ea07ec1928ace20016325672b0b

    SHA1

    b2b37040eff899d1372c3f26fe56baf5109428ac

    SHA256

    669166e01afc2480b3e04c4fb06ce64b5abd331052d2b2ba8da281f4d1703b47

    SHA512

    ddab693d9f39219159fb4ad790fd68205028d460f0d21ce88518bc0e10af3ea2a66d1de0c5e0431a1cbab450811ab684c5a67c8c2dbb983708a9641499cb9af8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    741b6b207c9ebafb6bdb4c8069875296

    SHA1

    b94b8ceee2f693e29e3d4ad94f4e43a7197bee0a

    SHA256

    6f3888d50943e43f86276f8472a9ad1d5a40a0d4006a449432f47ccaf7898101

    SHA512

    b8f195e38eaa1bcf0463b13d5364d500119bad65c748e347ec9a212e3a52024c7afec3d93a51bd7d62630a512134acd7b71d1a3955a1ddc815e21532eb851147

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    ebed88942e93380f4d3bdc99df0b273e

    SHA1

    25113763e991167f4866b6c3c59767aed8f1fd74

    SHA256

    b4dc8e8fe71a3557376ffdaafe87f5fca9d51f5e7c966c46f0972316c83a86aa

    SHA512

    1ddb596fbc5e126a0ec49c77226b245dedbc2d162b0346b31112485349da03892f79068ec76b10fa1fb77ca911b77eb86e39d7fd31d4c93f4027fb79619d85b1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    129658887341b937d85b4244e51f373c

    SHA1

    ce9a56aad4b6eafd2534079cc234bd2a2c9dcc63

    SHA256

    edd6ce1fa402c15c0942a4a97dd0fc47974f209b2b068c29f6cf8e446ba0e046

    SHA512

    0b2af45d6b2d7637d4b2ec68c321e4c4ee3562b517178c07e8036ac30a9657b49f10da84f360f03b236a498ca0be44661a9181c3c54b6627b784245b37c60cb2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabAAA3.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabACC9.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarAAC5.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarAD4B.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • memory/2772-1226-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/2772-1490-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2772-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2772-459-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/2772-1258-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/2772-1382-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/2772-1467-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2772-804-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/2772-1524-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2772-1557-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2772-1621-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2772-1624-0x00000000070F0000-0x00000000070F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2772-1627-0x0000000000401000-0x0000000000A18000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/2772-1626-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download