Analysis

  • max time kernel
    130s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 03:48

General

  • Target

    2024-06-26_29d510f6db117baede4c0d1bcd7f1a5d_cobalt-strike_cobaltstrike_poet-rat.exe

  • Size

    6.0MB

  • MD5

    29d510f6db117baede4c0d1bcd7f1a5d

  • SHA1

    2083235364b9648919248603d84c354b82b17888

  • SHA256

    5ca242aa62f885610415164e0d1569f642f4c439f3ebf5319a561afd782a00c2

  • SHA512

    f9e0f4cc2b76412edd8597bd55085700b29ca5a7cc9ecdfae24d644344b0178689d6aa4213226433169b22e41792bd108417554fdfb4ca561d7eedc46421d082

  • SSDEEP

    98304:EniLf9FdfE0pZB156utgpPFotBER/mQ32lU5:eOl56utgpPF8u/75

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • UPX dump on OEP (original entry point) 1 IoCs
  • XMRig Miner payload 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-26_29d510f6db117baede4c0d1bcd7f1a5d_cobalt-strike_cobaltstrike_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-26_29d510f6db117baede4c0d1bcd7f1a5d_cobalt-strike_cobaltstrike_poet-rat.exe"
    1⤵
      PID:2200

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2200-0-0x00007FF7821B0000-0x00007FF782504000-memory.dmp

      Filesize

      3.3MB