Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 16:25
General
-
Target
2024-05-23_83a9c9d4323cc1c8fbbdd073f5751e11_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
83a9c9d4323cc1c8fbbdd073f5751e11
-
SHA1
82a8c93bc1cf2e6acff2cfb8d0a7619eb0242359
-
SHA256
b68ded42b14484af617bc803500676f36f22c1cdebacb4f22ac3dbf20fc4a620
-
SHA512
e816fc6919482772321e2f31305070bd47deab4dde0a15dbce26700dc090f34d0a1db136fea853fb18ec6c21bca0853643cc1e208cc674dcfdb6c5a6aaefe750
-
SSDEEP
98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxEU/:53EnsxxDt73DdKrwapwbL/
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 8 IoCs
-
UPX dump on OEP (original entry point) 10 IoCs
-
XMRig Miner payload 10 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 9 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 8 IoCs
-
Modifies system certificate store 2 TTPs 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_83a9c9d4323cc1c8fbbdd073f5751e11_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_83a9c9d4323cc1c8fbbdd073f5751e11_cobalt-strike_cobaltstrike.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5e1774ccd88b0975c742698aee5847d1b
SHA15375252124fc2b25b5369b5c3ff106dbc7aa281c
SHA2568f07bac94b73811be42426d851d25dcfc4dc656a61fc8029033f432e1f3ef399
SHA512a828e8f6b233c36b8bf7d0ceb747e927eb20e8b40706506de0521b6417d3088cad39e80545a4458d5660845da4347de56497612d7c5d209c9a92f0b3428c7188
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
230B
MD5602222ded966fe7dfbc9c4707fb0bb4b
SHA1193228577905033115db74808e9eb16c98d10343
SHA256a278d3c54bd743b073d8948d927382ab77cf2c7ddcf11f8546a7aa0c642c9f01
SHA512de94d1a6e27e72d3e75000d5e317f51ecea16cd2e8c8974eaf7d512cf92ad51c9f7db7a6bd5e619135dfdf0ec0f004e2c9e66aeb42f2c318f890d9d14e755828
-
Filesize
344B
MD5817d68b029ead293e9a6df5c0cfbbd36
SHA1bef12039c2d8138e3e9acdecec3b3e48a0e6bdd0
SHA25696678c71581fe7b0366164164d131ed8a451d7aeadbd20b53c6dc54bec49a419
SHA5123f01296b7a4a9cab7f0ce233085fa17f8ee55fddcb749f62c830b3cd8b908e4a9020cdaaa290f09909b3f06d0c5923a128f3badce7db1add08755a47ef1f01a2
-
Filesize
344B
MD540ed479c2352ef5c0d1ca1a50b1311e3
SHA122b71a75af9bc12178a66602e2e31fdc73e64e2e
SHA256ab7859a0d5924c8db318a0e55bd9d077de01a705214690b3bfaf4a98c35787cc
SHA512b5ed68328b9bf1c12f61ef52711bc8a389c623a1502da296960feee5cad5847aaa76df8b7f20fea9614cafc4e87108014a3a0952cdd4c16233fb4d948866b412
-
Filesize
344B
MD57e9fc1e3944e769439a5240ccbedf664
SHA15444fbc2b4bfe9543c531032d339c65408257545
SHA25601c74fa7994157761091d459c15887b90bb6d798d6e2d16dc5ea2d4ee349377c
SHA51266091539e6bac3f6546fd1293ce2fd7326effc398a09a5519ce3b7fc325cac1129fc5a7daccdb8be13d0a7afb6cd96f2e13ac05725b828f45cf8989d0fe08a38
-
Filesize
344B
MD585985f43d324dc2fd7e5aef7df433eb9
SHA135b18cef49e8dd1646af6010ef860da6a620c13b
SHA2568516efda22f490c601e020f79163426f5e437dd43c809b70aea3b30c8461b1b5
SHA512d6cbd6178490e292ed1ae20fee566c3581f467932899c485948b3f95d727dbbbad206f11ca2d4d9d15095c86c062518a92f7ddc8eb0e9542b9ace1d18696626b
-
Filesize
344B
MD523c8e9be1e928587f1be4f685b1c5e9c
SHA10fa6a378691120607e0530d1cc662d27384b7b32
SHA256cc359fff8cd30e641b7e72b9f162789fcd6f55a217f8ea50f614820515812c09
SHA512450bcf3f46126e5299379d16c9379f73c9193b12a74f7bc518a368d2c4973b8f14a0d151ab96085af5fd90f50528ead3c7df029eb2ccfbc16626a7a69713f958
-
Filesize
344B
MD5ff7055f781d7659b4328a306cd19ed9f
SHA14e9abe6bb36468aeac863b1e2db69bcda88d8aa0
SHA25603c3de888be88fcc8e2fa3e9fd8e9858f8e705a13de2d0025fc6e4207f5f3f91
SHA512a9c642211fc0186b4373443e7cf9bfb92765173b48110efcd25d7bf5f8c0d2db013899098cff3402c4badfb4a9bf4ceb7e4737cb9e31925477adfcb9e748dd8f
-
Filesize
344B
MD57d90f074ff6b33f2e5d496e9e4ef7433
SHA16311834d6ac164b1c3f50cf631f1c5d872c1aa50
SHA2569a8cb56c741498f9c947b001b2121ca529aa5b352f54eb0cbac48d6adaa87827
SHA512d2adeb091eaed95857009ef8580fb28be50ae32da7bb1d6a084e80d827ddd6d4890ef568f2c01ddd8f30c2fb97d6d0210aca7e9a2ad592b4080fc7dccb692ad3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
136KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
12.7MB