Overview

overview

10

Static

static

10

2024-05-23...ig.exe

windows7-x64

10

2024-05-23...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 02:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_beadc15a71f71f86a5cd7f1c92bbb457_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    11.1MB

  • MD5

    beadc15a71f71f86a5cd7f1c92bbb457

  • SHA1

    d1ed1de1350353d2943efe852f3b261828aed65b

  • SHA256

    671937a256d96e8771f1951a905d6001aa38c39661c3602749e2aea5233e6855

  • SHA512

    9001cefe33807307886a2bce63e3d0694dbe367bbc484c308ee0d7bea3019a598a1ba0d66ffc705834fbc9cb61f5de2856c27bbb149e75edb98cfb6e6c50107d

  • SSDEEP

    196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWMq:dYXpkG6uDBuQjmrOHc

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • XMRig Miner payload 8 IoCs
    miner
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_beadc15a71f71f86a5cd7f1c92bbb457_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_beadc15a71f71f86a5cd7f1c92bbb457_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1188
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2084

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\7-Zip\7-zip32.dll
            Filesize

            11.3MB

            MD5

            ea8cdf480e99fb42502891b7c52e0868

            SHA1

            55b8e0c8ff9cb341124a1a041c17f57b856bab93

            SHA256

            45b232e022c7bb1f6fb56d6b30ed0fbba381cce4cac5f72a26c74062ef444410

            SHA512

            6cf899d6b3dad4b7e98b74cae1ad936b243f5e9e3b7e95418922dc62ae9cb7c91569db23e07027e78830ed14ff9b5b4d595328fd930cb03797f9fb1092ab6de9

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
            Filesize

            1KB

            MD5

            55540a230bdab55187a841cfe1aa1545

            SHA1

            363e4734f757bdeb89868efe94907774a327695e

            SHA256

            d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

            SHA512

            c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
            Filesize

            230B

            MD5

            df49f14eac105d1654b807c43369e409

            SHA1

            5745662d5041ac6efdc9606af612b368edd975cc

            SHA256

            46d4a4d58c39ca53c8b44be683d02e7ab846580604cd16f070a8e839ee227e57

            SHA512

            abf429a009c9aa6bb91f7201735b604dfed508c1f8aee372f62d2f2b10500ed41d9e41c296be0b925bf714eee6e67faf0a33c80ff314f4afd68b55cfdebd0c73

            Download Submit

          • memory/1188-204-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download

          • memory/1188-110-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download

          • memory/1188-148-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download

          • memory/1188-0-0x00000000001B0000-0x00000000001C0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1188-258-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download

          • memory/1188-338-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download

          • memory/1188-373-0x0000000000060000-0x0000000000062000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1188-377-0x00000000001D0000-0x00000000001F2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1188-378-0x0000000006810000-0x0000000006811000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1188-379-0x0000000000401000-0x0000000000A18000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1188-380-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download

          • memory/1188-382-0x0000000000400000-0x00000000010B2000-memory.dmp

            Filesize

            12.7MB

            Download