Analysis

  • max time kernel
    55s
  • max time network
    65s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2024, 06:43

General

  • Target

    2024-10-27_67cd9060b9faaeb89d7cf321698692d8_cobalt-strike_cobaltstrike.exe

  • Size

    5.3MB

  • MD5

    67cd9060b9faaeb89d7cf321698692d8

  • SHA1

    3de9a15bb35b4541308ed7268f7ace9fa6f32fd7

  • SHA256

    ff8a3cab3207bce30673ea12d6285400f464979b433e2902ec56beb20d140645

  • SHA512

    afab54e08cde4d38b57b62907ea6cfc4d30cfa5e51396bc7a1197588d97675015d5649ffa9ca9386b6d3646bb2b8df4ef80e5587fd42356d3bb0c9e120852bad

  • SSDEEP

    98304:IJ+g5paiu6HM2sH1mDzBuTcQxmsqK5C6y9+h+K2xb/XcLUk:A+g5pazDH1SzBSlC6G+t2xb/X7k

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Cobaltstrike family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 8 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-27_67cd9060b9faaeb89d7cf321698692d8_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-27_67cd9060b9faaeb89d7cf321698692d8_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2904

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.exe

          Filesize

          5.5MB

          MD5

          4de4cb1bc0a3e7dca79e33efff057793

          SHA1

          cc18fadd30c465fb974298a979e60e26104709fb

          SHA256

          bcdf0a598f06fae6404f66bf1f724560fc3a35b690ddade9f90beef84bd747bd

          SHA512

          0dff53abed9f38e91d17f7a20cc63c8287ae8a0de49eb026187bb705cb1d8ded6c3c1bdf365cb4c424fce9f16aa6b4a8a33c5b89da0a85b928b71b9ad2eb0e52

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

          Filesize

          1KB

          MD5

          55540a230bdab55187a841cfe1aa1545

          SHA1

          363e4734f757bdeb89868efe94907774a327695e

          SHA256

          d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

          SHA512

          c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

          Filesize

          230B

          MD5

          54bbaeefb6c7f5f023341ea7c07514e8

          SHA1

          db950b40e21de9a0be4cbfc68a3ae4ea825a8b2a

          SHA256

          498e8d74c33d3b58bec35614f22e534b54f1258dff38369b3e820d997ccaf383

          SHA512

          f7ea0e968bc0f1269eb83ae2650fd02e75bcf197806e249f288ecb0049a8daa955eab723daf1ee4f75956b3c77f2aa3e7ee942cf894fc9c9c70b20ad63b07243

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          e2f312ba372a307d8a20e856a7bfa2fe

          SHA1

          c9465929e9776092d06902753a4749abd7c9296e

          SHA256

          7b636d687860bd933498edf8dc3e0ff811a69844cbad85ec1ef792c40d4a8a2d

          SHA512

          cb7686f25864a4f141987861018459e4ae08328d09c34dfcd5832fbe36386881982702dff95b59282d6e631693e9c9a1d219934f44171ea906fcb6a50c9f55fc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          751263f88ed0bbbaac357ad4225e788a

          SHA1

          b84e31ed01ab3efa9f210c53c933ed75d74666a0

          SHA256

          00bf01d65bc7e0e6851314d8fa291adb5ec2a20f8e15d9070d7f56dfa8d37fc1

          SHA512

          d8ac413637a01bf42a87e7985ba5b521fb519267216417d3b4b6912cf0e71dd1800f2c15f0f7bd9f0256538f6c48bedfffdc2350fbf95d53f9acfec9c8dd8a53

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          3a4a12f5bfff0d67cb9b7268d4f11916

          SHA1

          33f6d73df821b5deb3dd1d980a30af887a3b2e0e

          SHA256

          223707644f54891d939dd47424c2bd76485c51a57213bfcf2bf9e086c2cfcec6

          SHA512

          b922475a408bb7b2a0355bfff0d07b5d04381ff6c2beee4ab18fc072f4d2ccc746c4b8541affba204a3d62a2f810665132bd52ca50bf022816eaa30dc1176297

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          74e7632f1c868a2e9904483ee263a9dd

          SHA1

          a2c2f3627648c012e0cff88167d7a2ffe9d4abb2

          SHA256

          c2fe6037f631c8f59408f7e49057bb68091505470eceef54130d7ed7685d6abd

          SHA512

          d637bfe1ba2ac299ee28af597605c95cf018b36086ba8495de2939939847845dfcf2d1c7799a4ae38a5fd846d7fc16793c7bc2fa7cd39f6805ef720d22c0d55c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          22c3260a2b62e24065bcf738e5ae76b5

          SHA1

          e486ae064f16fd86367ef9119478c4bdaa920a58

          SHA256

          6f90e5661e81cd1e2a699642c0d5988160000d9ada58e2a9763b9b81262032d3

          SHA512

          34b00bcd03419951b75e16a1fcfed8a7adc9c1ddde0a6204168a906ed621ed5456aff99aaa992edddfab30ae962826043e9dad466646312747eda511aa96e35c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          f339b208a892c43295ed39fa5524e5b0

          SHA1

          c252e89902ae28cc64b6dd614b27e42591a39d65

          SHA256

          7ad4a4b4a4ff9405f1dd440efb95615e2ce8399a062cf154ee99c74dde5982aa

          SHA512

          005ae7a6da47b40e130c40f739beaf89ed72c0561ffea1c3de6e3cd6f89a2b8622228b3407c5f7961efb01f6ce53bfa95b37fa004d0ca00b20b3acddf1dc0c73

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          35b914d93dcb8e24ec792025f4ffe0b8

          SHA1

          f8ec06d9609394be023ab23b408c295cd61a2fc7

          SHA256

          4dce57247656bdf98cfef74ca48d080274c50b4d2ad310611dd39508c3756faf

          SHA512

          e327fed40610dc7892d3bab278a1b3f8cff1a3bb3bb2078da966b6dbbb55c346f7e62740295468f8eaad09a56feec6fe852db89f038e803e485d64c73c096e11

        • C:\Users\Admin\AppData\Local\Temp\CabFA1C.tmp

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\TarFA1D.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • memory/2904-534-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1644-0x00000000002C0000-0x00000000003C0000-memory.dmp

          Filesize

          1024KB

        • memory/2904-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

          Filesize

          64KB

        • memory/2904-535-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-576-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-984-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1310-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1621-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1640-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2904-1-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1647-0x00000000003C0000-0x00000000003C1000-memory.dmp

          Filesize

          4KB

        • memory/2904-1649-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2904-1653-0x00000000003F0000-0x0000000000400000-memory.dmp

          Filesize

          64KB

        • memory/2904-1656-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1660-0x0000000000401000-0x00000000010B5000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1661-0x0000000000400000-0x00000000010B6000-memory.dmp

          Filesize

          12.7MB

        • memory/2904-1662-0x0000000000401000-0x00000000010B5000-memory.dmp

          Filesize

          12.7MB