Analysis

  • max time kernel
    140s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 16:23

General

  • Target

    2024-05-25_18fe5738d772328617229f3f94081f88_cobalt-strike_cobaltstrike.exe

  • Size

    5.3MB

  • MD5

    18fe5738d772328617229f3f94081f88

  • SHA1

    49bfe6ffdc4dd79174e31c017b166a229e8aa9fc

  • SHA256

    cf4890fc8d1467a7853a76265f2d3aa9434455be745b9508498ec7925ab8df59

  • SHA512

    4c0f6a10d1049e67217d54662112d7497b00dfcb50715c198ae250a078621e1cffb2f49f29c2b125769967254e3322defe3636ac3cfcaec5f9649d7ef367c17d

  • SSDEEP

    98304:aIZAxzp4OwEpjoyYRshEAlOw+Je5rFrmTox8pxUV:aIZ4lrVBoyYRshEAlsefma4SV

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • UPX dump on OEP (original entry point) 9 IoCs
  • XMRig Miner payload 8 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_18fe5738d772328617229f3f94081f88_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_18fe5738d772328617229f3f94081f88_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll

    Filesize

    5.5MB

    MD5

    a2d3973ec10c58348b6a375be43a32db

    SHA1

    3c1d579d890faacf30f896733cb4438e8f7d7dda

    SHA256

    fc7b38d143f6224d5c7b8ac222f90f265914695fbf42e20d02880c1ed6bbb72e

    SHA512

    9e498b2b3ff6cf5ac119188e83ee7e0564703dbfea6f5afb4136be27060f470ee1692db53b276a7914ece97304a26028d6c47ff329ee22b12ccd5ac954d91578

  • memory/1928-2828-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-1-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

  • memory/1928-655-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-1753-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-2316-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-0-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-3869-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-4458-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-4459-0x0000000000060000-0x0000000000062000-memory.dmp

    Filesize

    8KB

  • memory/1928-4462-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-4463-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-4465-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1928-4466-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB