Analysis

  • max time kernel
    132s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 05:03 UTC

General

  • Target

    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe

  • Size

    5.9MB

  • MD5

    72d941b988287bd615036c42d0ef4eb3

  • SHA1

    07dbc3c6d77f5c3caf24582c2416efc997892380

  • SHA256

    5f50b92a344c782f99b3a2a2d292822705de7412a7f184931719d95d87b00f21

  • SHA512

    305b91c1d2083e5d27c6ba6e8ae889025b107207fc1e18f9a29a7e39cc334f01ca2d1404437dd5d58777c1ace199492802dcf0179e3f3b9614e44959e9818ef8

  • SSDEEP

    98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:T+856utgpPF8u/70

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • UPX dump on OEP (original entry point) 2 IoCs
  • XMRig Miner payload 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2944

Network

    No results found
  • 3.120.209.58:8080
    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    152 B
    3
  • 3.120.209.58:8080
    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    152 B
    3
  • 3.120.209.58:8080
    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    152 B
    3
  • 3.120.209.58:8080
    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    152 B
    3
  • 3.120.209.58:8080
    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    152 B
    3
  • 3.120.209.58:8080
    2024-06-02_72d941b988287bd615036c42d0ef4eb3_cobalt-strike_cobaltstrike.exe
    152 B
    3
No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2944-0-0x000000013F500000-0x000000013F854000-memory.dmp

    Filesize

    3.3MB

  • memory/2944-1-0x0000000000080000-0x0000000000090000-memory.dmp

    Filesize

    64KB

  • memory/2944-2-0x000000013F500000-0x000000013F854000-memory.dmp

    Filesize

    3.3MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.