Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 11:43
Behavioral task
behavioral1
Sample
2024-05-30_f53965a7dd0bc1f4befece1e212e4932_cobalt-strike_cobaltstrike_xmrig.exe
Resource
win7-20240508-en
4 signatures
150 seconds
General
- Target 2024-05-30_f53965a7dd0bc1f4befece1e212e4932_cobalt-strike_cobaltstrike_xmrig.exe
- Size 12.2MB
- Sample240530-nv3dfsgh95
- SHA256 12d2e17056a95e55f5c8191dd0660b309df62e7034ad77955874bbe28320d06f
- MD5 f53965a7dd0bc1f4befece1e212e4932
- SHA1 30937cf32735f50e887ef27c545d2a1827580aa6
- SHA512 62ab8912dd3ded0ad36ebec6048363d7992aef4ad75066cb2372a29ed85e28fb6df7e38671a5d2d3d4a261b347fb83a7e287267f1ee29ecf5fe29b22d4e8c3d7
- SSDEEP 196608:u2XrSIqtPazmgL7uDbzVXUHXUXEOZmPOEDkfsLKO:uaWIPyquDBZtmPfkfy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/memory/3064-7-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - XMRig Miner payload 1 IoCs
resource yara_rule behavioral2/memory/3064-7-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig