Analysis
-
max time kernel
132s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
23-08-2024 07:42
General
-
Target
2024-08-23_17c4e2f05e4669c094193dae2257f46b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
17c4e2f05e4669c094193dae2257f46b
-
SHA1
5a51e4cd70d511b79110994b45835fd956270a29
-
SHA256
318d28bfe71f279b5aa6d3f42dd3a5ae41ae00fba6d719580f5cc655a803b3da
-
SHA512
6ac8609f08bb7f41730533ff486f0b8b4a81c6101cd47b67c9a6b948acc9113214686658db39eb1213bb1b5da70e2d20555f575a7c4c2116f4c076273d2f3c22
-
SSDEEP
98304:demTLkNdfE0pZ3b56utgpPFotBER/mQ32lUs:E+W56utgpPF8u/7s
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-23_17c4e2f05e4669c094193dae2257f46b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-23_17c4e2f05e4669c094193dae2257f46b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB