Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 00:43
Behavioral task
behavioral1
Sample
2024-06-01_4d07006b6a88959d50fcd7a84e071a90_cobalt-strike_cobaltstrike.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
2024-06-01_4d07006b6a88959d50fcd7a84e071a90_cobalt-strike_cobaltstrike.exe
-
Size
6.0MB
-
MD5
4d07006b6a88959d50fcd7a84e071a90
-
SHA1
d976265427f5749c20c0bb9306b29d3424d066f6
-
SHA256
74bf4e0e37d51bd13157d16d4d3e4e5d81dc08a3900e30a67d0287e4a34dfe67
-
SHA512
8f49bdbee9859916817d5414f7f207c8d80365d27ee09ddab6b1a9fceb8a09d8f52d2ce0a5ab408bd66be6f832afdfcc718a054dce57a831c6cdfa881def8ead
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:T+856utgpPF8u/7J
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/2524-0-0x00007FF62DA80000-0x00007FF62DDD4000-memory.dmp UPX behavioral2/memory/2524-2-0x00007FF62DA80000-0x00007FF62DDD4000-memory.dmp UPX -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/memory/2524-0-0x00007FF62DA80000-0x00007FF62DDD4000-memory.dmp xmrig behavioral2/memory/2524-2-0x00007FF62DA80000-0x00007FF62DDD4000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/2524-0-0x00007FF62DA80000-0x00007FF62DDD4000-memory.dmp upx behavioral2/memory/2524-2-0x00007FF62DA80000-0x00007FF62DDD4000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2524 2024-06-01_4d07006b6a88959d50fcd7a84e071a90_cobalt-strike_cobaltstrike.exe Token: SeLockMemoryPrivilege 2524 2024-06-01_4d07006b6a88959d50fcd7a84e071a90_cobalt-strike_cobaltstrike.exe