Analysis
-
max time kernel
132s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 23:42
General
-
Target
2024-09-20_147490bdfb60b8e61529fdc47bda543b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
147490bdfb60b8e61529fdc47bda543b
-
SHA1
56c123ebd361ada16790b941e99c4c037025c6b8
-
SHA256
3b013af6817cc662c454de0b66e412d598faca8b14f26784800ee35b95f1d63c
-
SHA512
cb6c307b37d89e8c3a7f7e677a062486ba138885946dfa2bee9b974a7099851ca2eb4d020b74f9ef758e7ea72f4f44f820c25c7b199b48fc0d1460e03138a1ef
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_147490bdfb60b8e61529fdc47bda543b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_147490bdfb60b8e61529fdc47bda543b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB