Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-06-2024 00:25
General
-
Target
2024-06-04_65b26ccc1ce3a2e3eaceec6119066529_cobalt-strike_cobaltstrike_xmrig.exe
-
Size
11.3MB
-
MD5
65b26ccc1ce3a2e3eaceec6119066529
-
SHA1
acce90f0c5bb4e4e1b691514372f4abe34734d66
-
SHA256
ef9d46c35d7fcb12bc1ff12d0c67192b60a20bcc140ac2563d796f0f369e2246
-
SHA512
795d2f82d123e49983ce1eba6b75cc305d9458c2d0898b5711b4e544cad4d34ee1072fbf8b9f1c606591bd69e68f68ab36d9fb0c6d5053c96430dce2bbc9309b
-
SSDEEP
196608:m2XrSIqtPazmgL7uDbzV0xpZr8o37nmPQLi7gCsLz9:maWIPyquDCzzmPfgCy
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
XMRig Miner payload 7 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_65b26ccc1ce3a2e3eaceec6119066529_cobalt-strike_cobaltstrike_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_65b26ccc1ce3a2e3eaceec6119066529_cobalt-strike_cobaltstrike_xmrig.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.6MB
MD5db0bce4baef495d53671300fbf2a6c94
SHA150a0b3ea8a33abeaa87682fd0c5a3599ffab73bd
SHA256152bc42e8992e0b8267e9ab0f1d25f72f7b1b265514eb93a241ac17ce594dc13
SHA5125e8c12de2bc7b865573f8ae21aef4656bddca5acdb856603c59c3369e60604d293eb4b563e5b21f68801a577c1708070130251d4fabbc5a53c2a04b51d71a6bf
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
230B
MD54133ef47773994b712fb9f51f8b5c736
SHA1a663c3601f948d22b66aa1016e01615f5a9a5913
SHA256b4934f02b41fd687a7988f7be59c201417b36e181cd0cea0932a5e4641136ce3
SHA5120497ae768d4a79d233e996107874eae532e1bac78958ab8bdf1e499be0046c0946cd0465585ecc1c918190680d28905eeb72bf07e497b529462be83c9fc66774
-
Filesize
342B
MD5ac4501fac785e3dffcb62ef58c45264f
SHA1f37a48b692ef24245251e49232b2a8687a233cdb
SHA256b9cefdbff14acda5f49a30b5feee3bf7617cf5212b9cf4fe2b8733c5c8f2db25
SHA512f70e5e657641d3f2aad9cae6cb41ecd80857d80452ab6bb7eccff9ef8f49808f889940f85bf77ba3cd0570e4235efc649f009b6f0ae39b7a2586ac7c2c417ef4
-
Filesize
342B
MD553aee91ed32eb764b86d3d701377f63d
SHA11606433505cd3ecc23e3e9ba533f78fa6691bbe0
SHA256e9a12dc0e4557f7f29adebd31395830b08f5e7d22f84c23975fe509fb9e36d3e
SHA5121c653c3317c39129564de780bec4b879ab46ea014f2a2fc639bb78098ddebc7250403daaa312a0d3d81a4e09195bef6a344aca4477354916f91ce81586f9c6a1
-
Filesize
342B
MD5a2d64db397cd0facb74cc9e9591d36cb
SHA1abf968f3711644352174e555a4fcde91c942a408
SHA256a62afe5fe2e9c56241b5dd7e09814c3cada44fa7c97e386f645da4ae984a8839
SHA51231b83fce61ed8b443f65631424dac53f7a2adec5bf28b02ae4034510861a1c4cb17179ae61c20a3af082aca5e894ed4f86034d3807759803a7bf078f2cf2ee2a
-
Filesize
342B
MD5dab6e2976d431d59e411133ca889b7be
SHA1e11a7cb5786fbd54dc19e5d417e751d7ce758abc
SHA2560e0edabdb882e0d6e4fe4284cd5aa1c19d95a3622b69217d3860aa0ba321a05a
SHA512a59c7618172f2791eb5dcff7a3e65eae0f2de75bc966fb233fa9c4b527dea6c0b8d1dbfca0f36ba280c0d01dc86aef22f5a256dea4baaaa22fc3d17c1d7f969e
-
Filesize
342B
MD5ea9c06c3d40e1447fa91c2b7bf8d973d
SHA1b5db6100517168a645c605fb38e6f4abf385230c
SHA256e990dd8cd09ea2d5f47350f9fc529acef6507fb0b6dbd30e9f06882dfebc7af2
SHA512ec243e3b81459760ccf406f9648d41996fd7dabdd1fb9352cc16124c9e4325bf60180686a68249e854760d98c8d732ee7bfaaee6c75bc8cc6a01a893c560e204
-
Filesize
342B
MD581d38ed34c3b3095d83e77c9d63b996d
SHA120f773ea7e80ec6190b47ff2037157d70bb2337e
SHA256903566391058b58872035a14037e1f7833b4f702f6d62f9fd567d2c8818c5054
SHA51212d6c9640fe12b839c75506b19c5435fdb7b3c0e20c4225ac44056132a1e9495def042313cdaed2e8e15e0373f1534952df4302c24a3bb21e301207d59d38fb6
-
Filesize
342B
MD5399f50137d563f610cb0bfec9dec8dd7
SHA17dac72a8e35cad310b61cbfb8314849eb9c04e00
SHA25661c23c1a480fa11b91721e054887779b32ca8eacb549b8cc360fd71f42f971af
SHA512316e5cee1790d5ad466a95db71b044eafbb44592b64648d129f7bed9c0cca54c7ffe6e802380e683e8b9f48480e443a3253fb8b354f4a9b245e2a0845b80d4e5
-
Filesize
342B
MD5ff10ed04cd6d113b871b363832424015
SHA14b4f514d74a4853e840de257c34cdff7ff63b617
SHA25623bf8a1409452c93e6f4688318d55aa7b2c947e8715ef9dfc04f0ec7a818c0af
SHA512b223906f6394fa264bf6989b9970d183cf60af782d84aa9dd397defa3fbe7b9cba761b435d33fe190eadfdeae0881b60851bc08bde553794704c1b6f9cc9c7e4
-
Filesize
342B
MD5e8e5c5da151d85f1dc921c06433648a1
SHA15e5f80965ba505bd25a371aed434a4a4aec0fe11
SHA2562c052a9316665a29680cdd15ca5c6521e9b3dbd877b300db07c258d417d8da3b
SHA5129ef447f83a39d7f59f2a6f300cc109e55b00ff083b181c8a2d88411d1c1a3c4fe4fa1cb9af4896c7b71b8435d54448dd74a3373f3dfef47148db9444b3620ae0
-
Filesize
342B
MD583f85e816cb71e416bb3914b57fea363
SHA15a97c11021276e64f6fdcdcd9ac4f1b507aa4b2b
SHA2565c8c12088a3b50c8ac0d8ccce06464b27a20cbe44d77f9d6daed5e38e6ad8154
SHA51298cdccd253b305496c471d264ef8ae0699c1319ba5d788ce31810b5d8116f4069bab20db16315922f03725c647663daa06eaeb037d12f0b95c7574ece8434226
-
Filesize
342B
MD5aa6d6396aa81c8aea1d8eb6270086b50
SHA17b46b9487fe40bf9ab596ab9ac50fbffe0123fce
SHA2564206f8ee22b0678efedffcc195e9ee09867f5c06db5c1a72b6c57a6d8151e8b9
SHA5125b68e8463b48dfbe2c62c6430209da4c584fc23b55d97a71a74157e079e67d048ca6aa1c390c39d012024b77fa89ca9c000cdca78551f350c4564325998514d2
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
6.1MB
-
Filesize
12.7MB