Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 09:48 UTC
Behavioral task
behavioral1
Sample
2024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
2024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d45784228c48eb7d35957031c1ac389d
-
SHA1
27050959764bbc924c8db6eabe3558f89a511617
-
SHA256
74c52888e87ba9d2bbd9268dd0e4499f9f3af67393aba468b34a79d31a556be3
-
SHA512
fee423ec4fe25cc6e7a53ee035b3971c722200150be8095da7021a36c8d54dbdf4975d8031b4e0bd235830ca2b4a9f90edc1f0fed9561d8d31efd75452b6a650
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:T+856utgpPF8u/7G
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/memory/3432-0-0x00007FF7CDC80000-0x00007FF7CDFD4000-memory.dmp xmrig behavioral2/memory/3432-2-0x00007FF7CDC80000-0x00007FF7CDFD4000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/3432-0-0x00007FF7CDC80000-0x00007FF7CDFD4000-memory.dmp upx behavioral2/memory/3432-2-0x00007FF7CDC80000-0x00007FF7CDFD4000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3432 2024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 3432 2024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe
Processes
Network
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
3.120.209.58:80802024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-14_d45784228c48eb7d35957031c1ac389d_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa