xmrig | b3cbaea4732e0cb33e073db0070046e3eaab7ecc726c41af2c7a7d12fefc254b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 10:32

Target

2024-09-12_2f19b495c0e31c01572b0e9b27f4ae64_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

2f19b495c0e31c01572b0e9b27f4ae64
SHA1

1dccd8ee4cc9fc465027da64a5fa9f1bb74b5553
SHA256

b3cbaea4732e0cb33e073db0070046e3eaab7ecc726c41af2c7a7d12fefc254b
SHA512

0ab4e2af947dd3854ceeff5432c5d15ffd8cffc55ec2c81d787f3d787e60a77d70e83de5c31b94a0772eefb287bbed639cf2c1521cf6215373c70e8d565a5350
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUi:w+156utgpPF8u/7i

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2060-0-0x000000013FDA0000-0x00000001400ED000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2668	2060	2024-09-12_2f19b495c0e31c01572b0e9b27f4ae64_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2060 wrote to memory of 2668	2060	2024-09-12_2f19b495c0e31c01572b0e9b27f4ae64_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2060 wrote to memory of 2668	2060	2024-09-12_2f19b495c0e31c01572b0e9b27f4ae64_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-12_2f19b495c0e31c01572b0e9b27f4ae64_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-12_2f19b495c0e31c01572b0e9b27f4ae64_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 72
  2⤵
  PID:2668

memory/2060-0-0x000000013FDA0000-0x00000001400ED000-memory.dmp

Filesize
3.3MB

Download