Analysis
-
max time kernel
133s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-06-2024 12:49
General
-
Target
2024-06-11_afae12cf3b4494c0ccebc41a34ff58d7_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
afae12cf3b4494c0ccebc41a34ff58d7
-
SHA1
4b79a9369c4f97c0b74ee71630698d0b2f8ad5f7
-
SHA256
0f09a72d0ce0e8d5d4f5f716c19e341cb35b8e36144c29cbdb46aa704e84cb99
-
SHA512
a23bed0a580f0ded32bc6533f9e71cf6943a2a7818b7b69137b040ecc42887ffc780991b66c50f97076d38561812207fffc4b07d4755897a84eb90273571c003
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
UPX dump on OEP (original entry point) 2 IoCs
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_afae12cf3b4494c0ccebc41a34ff58d7_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_afae12cf3b4494c0ccebc41a34ff58d7_cobalt-strike_cobaltstrike.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2888-0-0x000000013F410000-0x000000013F764000-memory.dmpFilesize
3.3MB
-
memory/2888-1-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/2888-2-0x000000013F410000-0x000000013F764000-memory.dmpFilesize
3.3MB