Analysis

  • max time kernel
    147s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 13:19

General

  • Target

    2024-05-25_ade75299613aba7d25361511c0b843ac_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    11.0MB

  • MD5

    ade75299613aba7d25361511c0b843ac

  • SHA1

    ac08eda01ad7395085f45ef84b4202432a292f70

  • SHA256

    8baf52bcf6bba53df5088d137614c655b569f2ba866d0b0ab4ab797a92c110a8

  • SHA512

    eb9d34c7818fd15ec94e441fa3d2debb48579fd6eccade5a89fd2057cf13f611e1cfd1d14e8947ef5c3c727936a62e28398c48d27a0bd98ed24c47c71e818fa0

  • SSDEEP

    196608:u2XrSIqtPazmgL7uDbzVXUHXUXEOZmPOEDkfsLws:uaWIPyquDBZtmPfkfW

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • XMRig Miner payload 8 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 9 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_ade75299613aba7d25361511c0b843ac_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_ade75299613aba7d25361511c0b843ac_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:4024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip.dll.exe

    Filesize

    11.2MB

    MD5

    9ab32d502e47e073d68c714c6e02141f

    SHA1

    ede549feddc45c42bafd2c1d6acae1ee596563b4

    SHA256

    8d4cf424ca4af56fec49431fae18af8b591c336c997a3d7110e198815a04047a

    SHA512

    70cd0fdedc307f1cbc3cae00d546d332e312179ca664e73ad7208e1273ff28e9dd45a9f70e10418fd491c4819c0a4a688ff14fbc0c0445a994db0b404750c79d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

    Filesize

    330B

    MD5

    e6f34dee36907f62a604715276857a04

    SHA1

    d34177bc8a30dc76d4aec5958425a44c9d9f1976

    SHA256

    8c8fbdbef1ea4bc2c68b40f687c4ce2756518f69813dd608303a9329cc1cb2f3

    SHA512

    b6769e78fd255866a2a0db666b15e8306234c743d6861d86dff53064e86ec6f7747eeacf753c89640e6d8ab0de09905910cde4f84e6e9e00bffa9847796be9b0

  • memory/4024-257-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-88-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-144-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-213-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-0-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

  • memory/4024-304-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-336-0x0000000000060000-0x0000000000062000-memory.dmp

    Filesize

    8KB

  • memory/4024-342-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-372-0x0000000000401000-0x0000000000A18000-memory.dmp

    Filesize

    6.1MB

  • memory/4024-373-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/4024-374-0x0000000000401000-0x0000000000A18000-memory.dmp

    Filesize

    6.1MB