xmrig | 66b825228257c178e3ba55f1dd3ac3a8fd4de62046355006c2b4f7586b2f1130

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 11:12

Target

2024-09-12_c8bc2bd58aa7565f0e15370ca38de5c1_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

c8bc2bd58aa7565f0e15370ca38de5c1
SHA1

35aab7f41ef902bd9a28ac8ff442fd90ea75ed9d
SHA256

66b825228257c178e3ba55f1dd3ac3a8fd4de62046355006c2b4f7586b2f1130
SHA512

69276342eba3ee4ac6b6ebd78daaada1c4595ec491721c9152fa77e39fad6c0a0c35ca4d2aa4720ec768cde14fedea0614e95b0bb35e94ec3d9febab4ddf2245
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUb:w+156utgpPF8u/7b

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2776-0-0x000000013FE10000-0x000000014015D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2976	2776	2024-09-12_c8bc2bd58aa7565f0e15370ca38de5c1_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2776 wrote to memory of 2976	2776	2024-09-12_c8bc2bd58aa7565f0e15370ca38de5c1_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2776 wrote to memory of 2976	2776	2024-09-12_c8bc2bd58aa7565f0e15370ca38de5c1_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-12_c8bc2bd58aa7565f0e15370ca38de5c1_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-12_c8bc2bd58aa7565f0e15370ca38de5c1_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 72
  2⤵
  PID:2976

memory/2776-0-0x000000013FE10000-0x000000014015D000-memory.dmp

Filesize
3.3MB

Download