Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 13:29
Behavioral task
behavioral1
Sample
2024-07-23_ae8a36003aaca074f7cef0f054c031f7_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240708-en
4 signatures
150 seconds
General
-
Target
2024-07-23_ae8a36003aaca074f7cef0f054c031f7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ae8a36003aaca074f7cef0f054c031f7
-
SHA1
d46eccf697da9e152808490527623d5183e7b17c
-
SHA256
7ed546bc128dbca74350b0015875d4b5f62388be25970ba8ce92c2b77a1f0244
-
SHA512
1523837f82f5128df14b2190b3c0ef00ad32f1e95298697ac8ca72f1b82d13ca2e6c9de3cd690c07b31ef2b2281e1217567c12e5a304ac0bbda0c8860361f37f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUg
Malware Config
Signatures
-
XMRig Miner payload 14 IoCs
resource yara_rule behavioral2/memory/2444-2-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-3-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-4-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-5-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-6-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-7-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-8-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-9-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-10-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-11-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-12-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-13-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-14-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig behavioral2/memory/2444-15-0x00007FF670530000-0x00007FF670881000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/2444-0-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-2-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-3-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-4-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-5-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-6-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-7-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-8-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-9-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-10-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-11-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-12-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-13-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-14-0x00007FF670530000-0x00007FF670881000-memory.dmp upx behavioral2/memory/2444-15-0x00007FF670530000-0x00007FF670881000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2444 2024-07-23_ae8a36003aaca074f7cef0f054c031f7_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 2444 2024-07-23_ae8a36003aaca074f7cef0f054c031f7_cobalt-strike_cobaltstrike_poet-rat.exe