Overview

overview

10

Static

static

10

2024-05-30...ig.exe

windows7-x64

10

2024-05-30...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 21:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-30_199959a0bd7d315618f175fdce5c6aee_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    11.0MB

  • MD5

    199959a0bd7d315618f175fdce5c6aee

  • SHA1

    fbbf2036a8aad93e025c367eb87973990a2d280d

  • SHA256

    ebe7829301a0b093a3fef4e2d9a75256c0794447e1bfd027902cd734570c483c

  • SHA512

    585f9c43e304b5f6cac588d86e6c2128cd6d428ba5299e233e9c1be47a09c9759328aa9065a38bf2fc2852a478012c2a69d780a5be6d62a4c0c06d0ccf443cdf

  • SSDEEP

    196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWhx:dYXpkG6uDBuQjmrOHs

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • XMRig Miner payload 7 IoCs
    miner
  • Drops desktop.ini file(s) 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 5 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_199959a0bd7d315618f175fdce5c6aee_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_199959a0bd7d315618f175fdce5c6aee_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2240

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7-zip32.dll.exe
          Filesize

          11.2MB

          MD5

          5456646e6f7ad5f7bae972a8b8a217ae

          SHA1

          eef625b19c354ab37ce7aee55dc518b67652c667

          SHA256

          249d8fa73c97927440aff8b1917862a5ea7dd476ad5ac45c054328eedd43db7a

          SHA512

          9cd10409ad63a8ea5f4fa250b76e41276367bbeccc40307980635f74e99b60d7790d8fe7f26704f9addbaa3defbc71c0b76fc190efc88fb8723f4211a9732077

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
          Filesize

          1KB

          MD5

          55540a230bdab55187a841cfe1aa1545

          SHA1

          363e4734f757bdeb89868efe94907774a327695e

          SHA256

          d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

          SHA512

          c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
          Filesize

          230B

          MD5

          7f6a7fae157d6b7a57aeadc7c3e63fbe

          SHA1

          d86ec251e33ea2223fba53ace1b5cfa7ed0c05b6

          SHA256

          ff2a0309926aa04851f449a8179cdf270d2d1a233cf71a88f1bb20927e156295

          SHA512

          cb858237618d496749b4cd5ae1cc84b14e70ec1088b796185631ca68ccef8b42809cd21e981eceb133a73f6182db996a9449ac77d47a6624afc0eaad3ae4a542

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          5e7812590558423f84b9dd992a795dcc

          SHA1

          a761877299f54d6588d0d50189b5937aa7cd8327

          SHA256

          02a4d894f5fb29bcc48bbb8fac2650016c84abc8279a8fea5a8f012a29c76e14

          SHA512

          3debb830987953ee38afd43ae90d2befca6883d43fdbac457bfeba331d791ec51a9fdec2deb66cd6017354c5b555b12e38b7f4e14aceef611fd0b43fd7e79ee5

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          25793e042c3c2676263c81ba12c5ddf8

          SHA1

          a778b5ad0eed22d88c1a2831532f81421c0aeafe

          SHA256

          7067d6a190d718e0c9cce4d3e936de5b3534b2bf56cac99db4074dcbb3c1479d

          SHA512

          138994dadaad5f749a5f2d9ca84d979d2367c7edcfcb028f5e69d5e9f4ba5d170dae5d10aaa1cbf4dc732bfea78be350b687b4058dab14e540b39df8c5e2ab19

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          373ec5ed64cedd7b515cdf0ba4458e98

          SHA1

          3adb9500b3175a658e3ff1d3d493662e5c7a3229

          SHA256

          eded7c49861491b8292f945716d1a5ac27c554a18b3a1a570c0fcaa63c760c4d

          SHA512

          260d406ed3e56d03611882f81d7c43b897b5baebbf553da52868e4f45d9279c8af08b86220c691faf979f0ce261d1248d9c8476bec8037ffd277c2dc40a94419

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          dfd3e41453bf24e65776ee61d97262b9

          SHA1

          a1431e61fb6f9cfe71cbe8a70033bbe1928cc14c

          SHA256

          2e71ae2216c3ebff7ac43e3bd7a777980ac2b2e519f4a4e6433738de4e4c410e

          SHA512

          d2a28e12926610affa4d81beff4bb73786ffde8f0c2c1d13e24a64168b1cb253acb8c49537a743dda4125ae9b28661f5a11ce6ea15ea02b11e0296b70aa14112

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          1978b9d97fd1421e53ad69a1b0559946

          SHA1

          15a3e468a48a020f6ec333d6768afa98da7f5a1c

          SHA256

          3f9ecc6339defd16eb3a47984ebeff8676abf29093e064d03fa7697448742f2d

          SHA512

          163f87af9a9e149a4c95783caceecccfb5b1bafff83811fa826ba113387fa5cc372630b4b4139c26c4e30c689953f1bf02b120935de6d1c56510c859a11ee53a

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          56ad0b7e2df975adfa5bab2d9bf6b905

          SHA1

          2ce47bee2bcacf948efc2f64133eae3b4493acb6

          SHA256

          15a517bfe3ca085b3361874eb2a78b8b1a0abb3abc9660107b2d14b62fe3e680

          SHA512

          d6a0fb6b6482cc8aef4c39c7df4eee2c31e66db259fd8f11fc680969e53a3d107559221dccb60f76692f712e242e970a935f681d22d4053ee7f031dfb404dc69

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Cab1122.tmp
          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Tar1135.tmp
          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Tar1292.tmp
          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          Download Submit

        • memory/2240-2769-0x0000000000400000-0x00000000010B2000-memory.dmp

          Filesize

          12.7MB

          Download

        • memory/2240-1517-0x0000000000400000-0x00000000010B2000-memory.dmp

          Filesize

          12.7MB

          Download

        • memory/2240-2264-0x0000000000400000-0x00000000010B2000-memory.dmp

          Filesize

          12.7MB

          Download

        • memory/2240-867-0x0000000000400000-0x00000000010B2000-memory.dmp

          Filesize

          12.7MB

          Download

        • memory/2240-2600-0x0000000000400000-0x00000000010B2000-memory.dmp

          Filesize

          12.7MB

          Download

        • memory/2240-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2240-2774-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2240-2775-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2240-2776-0x0000000000260000-0x0000000000261000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2240-2777-0x0000000000270000-0x0000000000370000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2240-2778-0x00000000003F0000-0x0000000000400000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2240-2779-0x0000000004B20000-0x0000000004B21000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2240-2782-0x0000000000400000-0x00000000010B2000-memory.dmp

          Filesize

          12.7MB

          Download