Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-05-2024 06:14
General
-
Target
2024-05-25_d5c28a6673a46cae85e6383c4d2e2008_cobalt-strike_cobaltstrike_xmrig.exe
-
Size
11.4MB
-
MD5
d5c28a6673a46cae85e6383c4d2e2008
-
SHA1
0ac9a83fb5897e1eef89e93b7889490ed826da7a
-
SHA256
1d1511fefadcdc16bd13684b66d8485ff0e42c14382c9e2fd9d27503f678938f
-
SHA512
2bcb23303fa7535b690104a36302b94fc1065720bd6e0b0b4314863f090909383fe93cf7ef273b1d6133aed8f1d23a87a0e197e1408f94a2236b6a055afb432c
-
SSDEEP
196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWhW:dYXpkG6uDBuQjmrOHL
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
XMRig Miner payload 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_d5c28a6673a46cae85e6383c4d2e2008_cobalt-strike_cobaltstrike_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_d5c28a6673a46cae85e6383c4d2e2008_cobalt-strike_cobaltstrike_xmrig.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip32.dllFilesize
11.6MB
MD5540202c64980e4af412058df9980643e
SHA14ca4ac4d859d32fc926c01c6a699ceeddbc2111d
SHA25644255cdb54945dff605ce8d714ce24593584c9ed4d577f540c96d02fdab712fd
SHA512f0155be935d3d1c9568f2ce64932b8a3041ec6385eb70b5de7a0f4f7d664b7c5efb2fd561763a908798181375d7c91658da2fe2ce7474171a13918b4e3e709f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416Filesize
230B
MD5c02928d2532ef2241871227d2f9b037b
SHA1688dd4b4430062fb3793cae6143a3abe3dde9713
SHA2566ba9169997853ed457f63f73995bed409bd27b4970c033710c485f63403121b7
SHA512d027c594e165d3cd38633132970a13059ad9bc0042c123242404ac94738d5badcd3278d0e34249363c2ffc372eb3b1c1e33ac2cbdfb73fe8826cdd4616977c8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD587514e7a5cabd23a6509e26bcd13a413
SHA108752c1095bb46e6de0a837668b25ca09752362c
SHA256149e234b4b3897cf3a5c8437d9afb133ed8dc34918819663857393a295f23b33
SHA5125d458132684842176b45495a4d5700f2f13d213f170eba2c66110cba3aaf2cc5b6e781932e3746d764338c13fda58df79b709b663614b85445a06ea59232c218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD591fdde48fd68afda4339b532ea28dd24
SHA1b4bc06c63c1fc99b8cf51067311446bad5cdae3d
SHA2567055abba1d2c131e220a5e7c513e05c6d6f2ca6b5850b84602361976f89075b8
SHA512e37ed1668dc81d5b18d93c8974731d23729b15657267f443b6ebced44fbb645248914ae076fa78fc9567feb90d5d87f4654d8eafe4be9db533d38443b8dc50df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD541ed4a633d1fec22da62b9e0a572e228
SHA1d9a5951775266c29a9fac5e2df42cb42ed73fe17
SHA256bb25859581846ff20d47674edde197f5b138d85ddc91912ef6a17e718cce08b3
SHA5129e3b72ad3c6656c95c983c549e0977abc1735c893d782e9b156924afdb9d04dc2e60e981fa01ab01025c45cd423cad5cd638093bda41e0e7241f9344d9dbcdfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b941c91d07111f6f1c587c2aa4f28e9a
SHA147ffc3de26049088e5aaa9b24e097480e8a2f4f4
SHA256dbae780cec69cf204724b09c917991a6970647ce3ad4c679193b854776b35aed
SHA512ddd0b1499666bf1e7ce0ada18ad59c3fb152d1cd5a2988014bd262e1faead307ad834390a694b3d97da96040aec0b198da47f6763cb1a9e96dea00532fcc56ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52b4f90c058ceebdd9d2a102f028c3c21
SHA1476cc3cc496cbdb5b4acd348c58435cf98a7cb4b
SHA25647c3a3b17153a220ef30be5e90a2d652327935ffdff432faae20a5b000342c3a
SHA512ff8342aba09a680c6a41d6eb3dcca0f31b140fe4e98a9c3b20976915dd5383e668f9c2c45b972fd3dc50f2cd7e9e9232e8d7701ffa74cd6eb349df3b02325f03
-
C:\Users\Admin\AppData\Local\Temp\Cab9167.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar917B.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar9317.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/1308-953-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/1308-985-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1308-490-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/1308-555-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/1308-635-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/1308-0-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/1308-983-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1308-426-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB
-
memory/1308-984-0x00000000002C0000-0x00000000003C0000-memory.dmpFilesize
1024KB
-
memory/1308-986-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1308-987-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/1308-988-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/1308-990-0x0000000000401000-0x0000000000A18000-memory.dmpFilesize
6.1MB
-
memory/1308-991-0x0000000000400000-0x00000000010B2000-memory.dmpFilesize
12.7MB