Analysis
-
max time kernel
96s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 12:26 UTC
Behavioral task
behavioral1
Sample
2024-09-14_cc18890ad9ad51a8de7298003b2a4e78_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240903-en
9 signatures
150 seconds
General
-
Target
2024-09-14_cc18890ad9ad51a8de7298003b2a4e78_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
6.1MB
-
MD5
cc18890ad9ad51a8de7298003b2a4e78
-
SHA1
7019ff1c2b961420d5420f22ea58d33962525c37
-
SHA256
ca934305ef08f2d460643a41a32bf39bcddecfcf8aa278d022f727e242a9c837
-
SHA512
aaad20a10c71e1c59c288e3969c9e1877e6080e08760b5cd3f3efc0bbfe870d488ab57ed67aba6f7e38676b0ef0dd6262389d871bddfde9bf53618986e823267
-
SSDEEP
98304:IapSdlWdfE0pZPD56utgpPFotBER/mQ32lUJ:32Y56utgpPF8u/7J
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule behavioral2/memory/2256-0-0x00007FF673E30000-0x00007FF674184000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/2256-0-0x00007FF673E30000-0x00007FF674184000-memory.dmp upx
Processes
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request79.190.18.2.in-addr.arpaIN PTRResponse79.190.18.2.in-addr.arpaIN PTRa2-18-190-79deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
No results found
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
79.190.18.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
73.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa