Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 01:08
Behavioral task
behavioral1
Sample
2024-06-01_8156b4388725cca420ccfd2ac5c76d79_cobalt-strike_cobaltstrike.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
2024-06-01_8156b4388725cca420ccfd2ac5c76d79_cobalt-strike_cobaltstrike.exe
-
Size
6.0MB
-
MD5
8156b4388725cca420ccfd2ac5c76d79
-
SHA1
5b134e407abdbb62aad24efe6287d02f13653fa4
-
SHA256
21d588e1991c3acd4303620e43a4008ca7493dfbc7109571dc77acf2f963e342
-
SHA512
632955c1c25485d10a6ed03e3b212f96cbacd8598acd8182a1b544daaad15f59c22ca648fe884474e8e032d3c5a9fd5548e2c22342504892e40339419ca3f3f5
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:T+856utgpPF8u/73
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/6084-0-0x00007FF7AD5C0000-0x00007FF7AD914000-memory.dmp UPX behavioral2/memory/6084-2-0x00007FF7AD5C0000-0x00007FF7AD914000-memory.dmp UPX -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/memory/6084-0-0x00007FF7AD5C0000-0x00007FF7AD914000-memory.dmp xmrig behavioral2/memory/6084-2-0x00007FF7AD5C0000-0x00007FF7AD914000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/6084-0-0x00007FF7AD5C0000-0x00007FF7AD914000-memory.dmp upx behavioral2/memory/6084-2-0x00007FF7AD5C0000-0x00007FF7AD914000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 6084 2024-06-01_8156b4388725cca420ccfd2ac5c76d79_cobalt-strike_cobaltstrike.exe Token: SeLockMemoryPrivilege 6084 2024-06-01_8156b4388725cca420ccfd2ac5c76d79_cobalt-strike_cobaltstrike.exe