xmrig | d3a4949109254eefb26c46bf4df80e217498b1f2bafc52c7001875eb3e55c33e

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 08:27

Target

2024-08-18_0f8c483b2b1d4d15e1e85badab68a7e5_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

0f8c483b2b1d4d15e1e85badab68a7e5
SHA1

3f57b77d14b87063e558c39d4f2e0ce1d4f588c4
SHA256

d3a4949109254eefb26c46bf4df80e217498b1f2bafc52c7001875eb3e55c33e
SHA512

f957db9cb2064a890585239c9a5aeeef539542eb0601007a85d02ed862e7e34a837aaf531b768529f56d856ca529589fa3111786fa3f64b07d6b288d6937ca74
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUs:w+156utgpPF8u/7s

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/1052-0-0x000000013FE50000-0x000000014019D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1668	1052	2024-08-18_0f8c483b2b1d4d15e1e85badab68a7e5_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 1052 wrote to memory of 1668	1052	2024-08-18_0f8c483b2b1d4d15e1e85badab68a7e5_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 1052 wrote to memory of 1668	1052	2024-08-18_0f8c483b2b1d4d15e1e85badab68a7e5_cobalt-strike_cobaltstrike_poet-rat.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-18_0f8c483b2b1d4d15e1e85badab68a7e5_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-18_0f8c483b2b1d4d15e1e85badab68a7e5_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1052 -s 72
  2⤵
  PID:1668

memory/1052-0-0x000000013FE50000-0x000000014019D000-memory.dmp

Filesize
3.3MB

Download