Overview

overview

10

Static

static

10

2024-05-30...ig.exe

windows7-x64

10

2024-05-30...ig.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 13:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-30_4758ce9d5f269165702d30cadc55e19e_cobalt-strike_cobaltstrike_poet-rat_xmrig.exe

  • Size

    12.2MB

  • MD5

    4758ce9d5f269165702d30cadc55e19e

  • SHA1

    5876e473b0f1958f1b556b08650fc03c57fe4d90

  • SHA256

    53edb0049502b229a84a16f0cadd736d2c22496f3baa1b3d77021a7d9792a27b

  • SHA512

    9be357e456d55ba78b8626d59a2ebc4a0aeb3ff17c7d640b144b19fa0063790dfb7f511c0aa0a33dc94930c31a510de413472db097c01d6d1e20ff4b5bef42b6

  • SSDEEP

    196608:u2XrSIqtPazmgL7uDbzVXUHXUXEOZmPOEDkfsLKe:uaWIPyquDBZtmPfkfq

Score
10/10
cobaltstrikexmrigbackdoorminertrojan

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • XMRig Miner payload 7 IoCs
    miner
  • Drops desktop.ini file(s) 10 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_4758ce9d5f269165702d30cadc55e19e_cobalt-strike_cobaltstrike_poet-rat_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_4758ce9d5f269165702d30cadc55e19e_cobalt-strike_cobaltstrike_poet-rat_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi
    Filesize

    12.4MB

    MD5

    8c3299f7c31c152228c0f449f275fc00

    SHA1

    c827f4639140e1d8aa4bfb6efc0915816011811d

    SHA256

    bb16ca19e92bbb51efea8362cb6684c33dd866ad6977e115efd90f7d0b694bc2

    SHA512

    7b4d201444bba8c0ffb1321dd66ca533ce47aa9c8b6c8b492810043c73ec5e7ca3ecdbf26fac416244104acbe4e9c50582388f0b35364ee97b293f3336bb5f2e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
    Filesize

    230B

    MD5

    6329008f3782d8b07647852f54e5c037

    SHA1

    e8f2f1dc51a2901a1c4692adb112f5fbc95f747e

    SHA256

    7544e358be37f1fca37c700e5291714636f67f03c67ac12a7eb0c831e81e7422

    SHA512

    4e67ed535c15542b6b6c26675b688efea89f07a1be8892e8d6cb1e7c16b65c9397cdc72b8f900d676395363a9671ba78a45251da2a6fa530209a2d0a527104bd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    620da034f804a458af69c2419755fa20

    SHA1

    9d7869740291b00d0aecca1a0df1e7e7306266e7

    SHA256

    62397458ada0e2f96533aba2a03b9f488ffd6b149068f3a5c3be2117cdb11814

    SHA512

    6bcc2929313dfb04831203707f31d609411be24e079546547d9c9cc428421a067ad7a29adc772ad223a0cba33beb5acf2776e6f6c47290d3c9fc0cda9533fbba

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0b6db33a3d100b5a6237b5eba8a35f4c

    SHA1

    1e2efb64e41f78e2e69fc6eaabab326b02da8ff0

    SHA256

    bb6a42f1acecb9c4307bd91c5fa1b71fe42829094d24c9f724e1e676a93f73b1

    SHA512

    eaee536afc47e3513ba544bcc9199e7227b2ce33d5c3bb7bb9a1d2dd176172668b137678ee2e86f4e4566c40538e1bd8198e6a43fa9abf9ff08327cccfab4698

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ff2f0ebf88b72a2a50ef3793d6e44709

    SHA1

    dfc8b6930e1e0e85b67c7d8cd708ac4afe1c0718

    SHA256

    352e4b135559f4ccbfaed98fedf66eea3b6a88ecaacd9ca19c79e15365f2829b

    SHA512

    ef86df1e080994c55e8a5d0724bf1b1e3ed34e97a49f0cdcc7b8865532cf243e4ec16990d050119627c0c39990efbb2581a02d263fec4c189ed6a0eeeac32032

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0990adf604b8257dc31afefc7422e250

    SHA1

    639d58deddd018e62b9e944e61d8465ba06a9130

    SHA256

    15352d730d85201fb66f1dddc04644815863be9957e9deb67847cd2435f83b82

    SHA512

    469fd3c8e18127f4fd74a02cc40e397ebd487feb8e95d3f4929ae1e6a82a686d92c57af6dbe23caa1365a43fa34f516071f4c17403a7f260cd7898a1cab333c3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    42c14fb73348730b1a9cf481e67d5683

    SHA1

    45de704f0e19e2762c3b96807e0b026b1fc54585

    SHA256

    4c77641a3ce93f90d175b1eaaf504fece4ed3eac9c5036362a95a954692750f2

    SHA512

    9f3d7281dd9d378a279681849eec19c8bd39b91e0748a7b23ebbc46bb49aaf08d154f2ed2d8062c2bc962f494e98cfe8bf5cdcd037d486d2a7398aea46bd71c0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab21C5.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar21C8.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar2335.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • memory/1936-1872-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1936-793-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1936-1311-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1936-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1936-2365-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1936-2797-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1936-2833-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1936-2835-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1936-2836-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1936-2837-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1936-2838-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/1936-2839-0x0000000000401000-0x0000000000A18000-memory.dmp

    Filesize

    6.1MB

    Download