Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 13:47

General

  • Target

    2024-05-25_f709278e0893345107ffd00787438a21_cobalt-strike_cobaltstrike.exe

  • Size

    5.1MB

  • MD5

    f709278e0893345107ffd00787438a21

  • SHA1

    85bbba8d3a1090013c190aec072b2688e1e4afee

  • SHA256

    ebc6637dc30bfbb83700b59754fc9a99cc9de855db0ba3dead180cf770d01555

  • SHA512

    17ad10eb0bac2d7955376a328f65fd5d06c60bf8f450e645779cfed4f1357bc38c2e24a43578dd705a9e95c7130666217b4bd1f3c6ec89e5e34ffce94b24fe36

  • SSDEEP

    98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxjUC:53EnsxxDt73DdKrwapwbkC

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • UPX dump on OEP (original entry point) 10 IoCs
  • XMRig Miner payload 10 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_f709278e0893345107ffd00787438a21_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_f709278e0893345107ffd00787438a21_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll

    Filesize

    5.3MB

    MD5

    7df8b058c637ea67797d16a5d89d1160

    SHA1

    333614d49ead59635beb591c2191d05c907c3051

    SHA256

    ae59b450a1b17f669a24f6021dd39c0afe8958940fb3ac353c603bf2e34e7b77

    SHA512

    25ec2295b6837b7ec09250dde508a6da42d78da224ea387fc4e947f47019ba0c36495ead2cb889e020e019de4f9547af9e4a21e60960a0818f54d01b539827f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

    Filesize

    330B

    MD5

    a1d6cb2dc55c5b049e12f8a7f6177c66

    SHA1

    b49a90e43e13e2c7939925658ce1acaf8295ebec

    SHA256

    bdd23c2cf1bf4ece4403cb2b8e812220207d2ae39a44e7eecc786c68e3e26ad9

    SHA512

    8ccb569f3a967c99203db7f13b9ed410e11efedf643063e4a79ade789ed55c5c7a4ab15119a08dd055db7f4e0db91d78200349a21c1a7cd0c0619395f5995da3

  • memory/536-2958-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-3884-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-444-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-1282-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-1782-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-2034-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-0-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-1-0x00000000000E0000-0x00000000000F0000-memory.dmp

    Filesize

    64KB

  • memory/536-4243-0x0000000000060000-0x0000000000062000-memory.dmp

    Filesize

    8KB

  • memory/536-4250-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

  • memory/536-4270-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-4271-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/536-4273-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/536-4274-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB