Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
29-05-2024 11:50
General
-
Target
2024-05-29_555d8c9905b9d2f0fb9359812fbbf04e_cobalt-strike_cobaltstrike_xmrig.exe
-
Size
11.0MB
-
MD5
555d8c9905b9d2f0fb9359812fbbf04e
-
SHA1
e66443606d18707226b809ac1cc2344f7a2045de
-
SHA256
5bf4e0a39786bfc9a72f8d1aea0674c934bbc472a36b26339431de7adfdacb8d
-
SHA512
a9702d8b2871fc52eb44fcbe64a53b8386d363782884f8513cbb9a73041dbb49c913af2a36e4cd5494965364095d8d48d949b78628b1ccb104d110bae5fc0b9e
-
SSDEEP
196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWlD:dYXpkG6uDBuQjmrOHG
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
XMRig Miner payload 7 IoCs
-
Drops desktop.ini file(s) 8 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
-
Modifies system certificate store 2 TTPs 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_555d8c9905b9d2f0fb9359812fbbf04e_cobalt-strike_cobaltstrike_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_555d8c9905b9d2f0fb9359812fbbf04e_cobalt-strike_cobaltstrike_xmrig.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.2MB
MD52ad318cb66c890bdd9c355beba809949
SHA116c360434f1b005519e14dfbb14aca4880da4b2f
SHA2569689d91f8e0e834020b2f43029718b54abd3975fdf93805a98d29142fecbfa6d
SHA51262b24506f0b3a0b153de07b49b1cf65a269ecd54eea75ea92cedfbb140b58b239c4c933310c3a5fc363eb05ed4dc739085c1c656adfba64e1a6f6422dca9c56a
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
230B
MD553159e28537884016bcbb5a73ededa8b
SHA1be1ac38a3b0a3fed41835f0444a3cf21484bddf5
SHA256b4f181df56428631310ba4e5f982d744bc258c625c0044cb5e776f4acc0edec4
SHA512047da1773ce6f2ff432ff02a0172c0f3bf41c19f36378593e679176f01aca1e7f78f87a0aac657da91afcd1dabce3b66de7eebd36e834da1c00121c15c28017d
-
Filesize
342B
MD5a560d9c8bcc0dee90d3b0a8ab62f25dc
SHA1c600c721c9d4178cac6dde6797a81de6ffc75bd9
SHA2567beb6a5462f27b03d59deeeb5628b1b478a609e1458bc3080bcc3529272d5826
SHA512fc901c66954353e5ab82e8355a3919b01d61fa488784a6d4275f769b1d40f649385eddb886fc84dc50b94aab660494a7b775afc56d2acd6c9e908eb883af1d58
-
Filesize
342B
MD57a122c6debff97748e4c5d7d5e391736
SHA10c3cdcc49f28355ad5fbdb9daf468a0a377c8f2a
SHA256fe3e91de731e3c3d7a8710fb069aac2e59ba4dadf8a66dbf8e7bc546fe7906e6
SHA512246f2b0064b7393171e699ca55f81aaad32cad2c096d150b17ec8620a02b3ec52cc6fd5877920507bd958eb35fc253bce58dad3c5edd11e8bb26808c3280cb3e
-
Filesize
342B
MD58209933f8775c6ef866a1e60a2af011b
SHA1c6c7ff20843785a270c5331d61f9b07560928506
SHA256d71292ac22dcf5b5d3869d7b764feb7af571ff9e06c93889e569d58e584a10b1
SHA5125b1ef31ca49a12801d84d65a13f0e6feecfd48c9c566d6eb74a15ad8f055b58ad3911c90b7861e724b80594c865692b7b3ba8b8ffa0d53b87f06e5cf1b19d02b
-
Filesize
342B
MD59ef7eab2de0c16a9d57e8be0e682bcff
SHA10c057bc6a8b4cfff3c53ac56d076e3932c0af715
SHA256103ad6fa00922966a156f3de73378a9e529500c7d22c7ac20b0f72525dd026ea
SHA512a2f290d9f663de5b1f1c450133a56e2ba76464f3add2f60245921992e5618f949d8f8ac1704c308b0c5a6db60a93f3ed21046dbe62eefaf5046fcc1bf5fc73bf
-
Filesize
342B
MD57c2c7c3faea4c264733dfae225a31a7c
SHA150ba35a79deb37215a978c85dd93a4a3e0a4e2ed
SHA2564d11ecb8b8e6d45aac5622e8dec8fe083f703fd91f1b6c6d4d21182620379765
SHA512cf2d7f82c78f960fdc8a06dfecd8fa2dd57408d4625159cb04f40bf3cd21994be1cb2a3fb9dcc3aa659a6bdfc2b5d8130157b86363bcfc76e2a9a4360e580aca
-
Filesize
342B
MD5fe8de91ec43050e71f7be7debe0e8285
SHA1ca12ddd734f8aa63b5c78760eb7adf49fdd0fc07
SHA2567b1eeb021a821189661e03175126bd7356ca464bb839112b7a00f54695b5ba9f
SHA5123b7e6ce01c3b06dc471ca562986bd8bb61c675cd7ecd00f3c0da28463271ced9308a81eb13b82cc041ecbb0ba101fcf4e56d6692380fd04795a076e97974053d
-
Filesize
342B
MD57beefdd25cc3415f29e4f1d86befe530
SHA1c8febdd4bdfd1818ef2563b1cfc563f08a385407
SHA25627367eeb83892b303a66309747ba97308b00e19c81591656b021a1441721bd42
SHA512ca19c9911afe0c77e4e7b27d815b99206f3bf6b14ccfc43c0c08550cfd28f43b6bc5a001a1c6a83c994819ee40f79f7a3aca2345d4118729af438a9b74079b79
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
136KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
12.7MB