Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 09:40
General
-
Target
2024-09-13_fb767c598c0513e781d4c8d331fb0cc7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
fb767c598c0513e781d4c8d331fb0cc7
-
SHA1
498137b0b0307752b39c99f0b67ba3f695ccb80e
-
SHA256
f35960d02abd99bb78cd2ecfdee05edbcbed180a98de33ee12d6f00d05a1231a
-
SHA512
204fc76e4cb438b0a592c41438666575883e4e3c9809f9ddca695f4fab42cdce6eeffef3fc0edd8a9dfb928aaaed5e4ec1c4205ff2aac8ccb09d5854c132231c
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_fb767c598c0513e781d4c8d331fb0cc7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_fb767c598c0513e781d4c8d331fb0cc7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB