Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
25-05-2024 06:29
General
-
Target
2024-05-25_2cbbcf36f9bedbffb10f821eb280c001_cobalt-strike_cobaltstrike.exe
-
Size
4.9MB
-
MD5
2cbbcf36f9bedbffb10f821eb280c001
-
SHA1
1726ea09c6af1714a1dd8b9a47782f33ac99d742
-
SHA256
b2682a2b6fc2c23a7ee8d5be63e8ff378f8953168aa9a776411979b20605a3f4
-
SHA512
877270c949890c4af87ddc425628df80274e73e938a20224b1a0b30d91d4c248aca92929ba6e6fa01d185f76df962a639d5efef0b34da1cdb86e3628081a2096
-
SSDEEP
98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxOUk:53EnsxxDt73DdKrwapwbRk
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 8 IoCs
-
UPX dump on OEP (original entry point) 11 IoCs
-
XMRig Miner payload 10 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 9 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 4 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_2cbbcf36f9bedbffb10f821eb280c001_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_2cbbcf36f9bedbffb10f821eb280c001_cobalt-strike_cobaltstrike.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58d602d00dc508d55e2aec138b571342f
SHA1ae24c819bc7b097f0d55f3d164444ffc4f71e36a
SHA2566e5b7c64d7347f9300c04809663c5cfcd33b118aeeb5ec73ed026f0b82a8bbe7
SHA512c87cf6fe8bc5f576c782e334436e53f9f4c28d1c56320ea1c137dd23a791c394ab37af43c8c418e1ed9e3221b38b02fe69f77faa3ddaa4e2bba8267d500fedec
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
230B
MD53963de228a4243706353b8d812307d37
SHA1d44e3b77eb205af0d7618ada56a942b84772fc09
SHA2565c6c982edc6218ed186f380ddd7e539e83d848ef3c90b583c822ddab9fe72c84
SHA51269b613755bbfc68f504fd33f0890d81b241ce553ef0e380f8f2b1bb28e275a1f9d1922aa5f564815373f991a51f9288e842f9bb83426ffb494ba694c8c4e777c
-
Filesize
344B
MD55a945cc99c6333e08a2711e06ee2e8f8
SHA11724ed2ebdb40964431bd6f1093c3cdcf373f75f
SHA2565571cbf7ba5dd9101b3700a791cd166bd6a9886290dc8b07cc09201dadbbc113
SHA51235e1431c3a30af2517ea2b2ed8fb5b86115c6a563329b10ae4b24a5d336ca5d82176bcaf42f3de11aced95f4876cd3734ccb047c619f9f22a90fd83568c01265
-
Filesize
344B
MD54f30a0cd1904883d6b11330fbcc3ead0
SHA135ba064697f24cd722edc150386b996fd21e1f77
SHA256560769c014ab4a88dc15fe6fbf7932146995b3a3c6362534efa8fe5cbcd920e2
SHA5124706e9106dadf7c076270035d70f8d74ea3b2fe96f6e388bd3452e528a028e2414ef8c327c0ef0abc904429e2a52207a80c6f82c8ae1b2dfb715d1c2e04af07d
-
Filesize
344B
MD568a88fe012db54b7ca005884cc0c1bc4
SHA13e855bf1911c870a4f52ea01fc45b530751429ad
SHA256962b4de7113b520ab07f2fb660f0b200ec46e617506e7c053412ba6d6fb2d93a
SHA512b561957d1ea5042673c7899a30a08eb469fc97dbd0aa783a75cafdac95875c02270aa3526e2bea25bb96fe950f8a1d6d5271f8401913b22b8270524f9dbcc1e1
-
Filesize
344B
MD5a9287ea4b2f967de01a9bb2dd21e092d
SHA15c6d92a8948d08d625c0a9d0d3e089818323204b
SHA256b76034096de25707d751a6d649ab95093a1547ca0aa2b1babb1367ccd4edde54
SHA512963f470c4e4a151dbc61fcb4ee3b2569412fcd590b25646d622923eec19438bf3c915728f9f7fd5f7086be22d534582ad13926f9ae7cb533d77bb0d7ef43eb18
-
Filesize
344B
MD50f07e6db6294ef1b3939e40c1d417015
SHA16f196f82b345219e28c46d35dd625020ce06692e
SHA2564b02c14e83eefa2b2b9d2b8dbd091a6432b079b5914b111f109c79cf4d1c2dc5
SHA5120d254b8aae59ef7ac94e1c2ee82f932c1104b2181b6bf5fa9396d30d2bed32c53e5fb99ba97c6f840900f2b22f1493e961f4d147257ef19e1b439299ae2e051b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB