Analysis
-
max time kernel
131s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31/05/2024, 19:39
General
-
Target
2024-05-31_a03cb09e6da32814bd06093cd557f398_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
a03cb09e6da32814bd06093cd557f398
-
SHA1
8b5ffccaf1b01c41afbf8f5273ff5f56590fa0ce
-
SHA256
a45b51ca3a6c1b05fe3123231699d03610ed8bcaf8f2be1a4610abfda1b892bf
-
SHA512
d02b7e415afb8d62c40ff58d148e9f213783e421415cee65bfbfecb2f0d5b3379956fb6b84834942a08ffdfedc50db83f330f540f21426843422ce4483872601
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
UPX dump on OEP (original entry point) 2 IoCs
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_a03cb09e6da32814bd06093cd557f398_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_a03cb09e6da32814bd06093cd557f398_cobalt-strike_cobaltstrike.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB