Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2024 04:30
Behavioral task
behavioral1
Sample
2024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
-
Target
2024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
55c9ac5f1becc21e9c942fa2d2db1ca9
-
SHA1
8267fed1e5bc420bff89bec4a4074bc09da4a3d5
-
SHA256
6a8787f2525fa4b41794fe8e31fd57af9cb44f48bf68525f4eff80d82a062b58
-
SHA512
1915cff374819753c01745739abe2e7abb5e300bcc72ab13b7f8d5bc0d95fb3fa78ad3fd868b2729fc39c3993a7e6ab6d92650f72bd145e314b2d508e6973aa6
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/memory/3972-0-0x00007FF775C70000-0x00007FF775FC4000-memory.dmp xmrig behavioral2/memory/3972-2-0x00007FF775C70000-0x00007FF775FC4000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/3972-0-0x00007FF775C70000-0x00007FF775FC4000-memory.dmp upx behavioral2/memory/3972-2-0x00007FF775C70000-0x00007FF775FC4000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3972 2024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 3972 2024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.143.123.92.in-addr.arpaIN PTRResponse240.143.123.92.in-addr.arpaIN PTRa92-123-143-240deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
3.120.209.58:80802024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
3.120.209.58:80802024-09-18_55c9ac5f1becc21e9c942fa2d2db1ca9_cobalt-strike_cobaltstrike_poet-rat.exe260 B 5
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
240.143.123.92.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa