xmrig | 9c35e7dcaf4361de19beea709e9f737eb9542994a57e30ef8304d099771f496a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-18_b5ed3872d7c46f686e40153b24b413ab_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.2MB
MD5

b5ed3872d7c46f686e40153b24b413ab
SHA1

c1bf52d8a61a0faf0fabf6b4b49f3bd99cf27338
SHA256

9c35e7dcaf4361de19beea709e9f737eb9542994a57e30ef8304d099771f496a
SHA512

4aa2aab2181d949a4a6adf222ce300d0bfcbcf3193b2a4696f77ac35ab4b807a3c0cfaf7e305afaa596e1009859ea6638b5663542dd09f753632bffe4cece110
SSDEEP

49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibj56utgpPFotBER/mQ32lUx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral2/memory/3532-3-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-2-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-4-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-5-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-6-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-7-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-8-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-9-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-10-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-11-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-12-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-13-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-14-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-15-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig
behavioral2/memory/3532-16-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	xmrig

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3532-0-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-3-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-2-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-4-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-5-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-6-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-7-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-8-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-9-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-10-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-11-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-12-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-13-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-14-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-15-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx
behavioral2/memory/3532-16-0x00007FF764FB0000-0x00007FF765301000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3532	2024-08-18_b5ed3872d7c46f686e40153b24b413ab_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	3532	2024-08-18_b5ed3872d7c46f686e40153b24b413ab_cobalt-strike_cobaltstrike_poet-rat.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-18_b5ed3872d7c46f686e40153b24b413ab_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-18_b5ed3872d7c46f686e40153b24b413ab_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-0-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-1-0x000002107C010000-0x000002107C020000-memory.dmp

Filesize
64KB

Download
memory/3532-3-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-2-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-4-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-5-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-6-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-7-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-8-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-9-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-10-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-11-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-12-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-13-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-14-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-15-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download
memory/3532-16-0x00007FF764FB0000-0x00007FF765301000-memory.dmp

Filesize
3.3MB

Download