xmrig | 3cd13114c7c44b85594706fbd4524a810e511385dee061542ac6b7805fcde2d7

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 09:29

Target

2024-09-20_92ba57503d63d0c20e62f6e1a973e5d8_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

92ba57503d63d0c20e62f6e1a973e5d8
SHA1

919a9ff975a529badd5471fffb14064ba2b34abf
SHA256

3cd13114c7c44b85594706fbd4524a810e511385dee061542ac6b7805fcde2d7
SHA512

c825af8007bf41947d3c5c36ebd2017de51273d459a963875e09e35154eb6fe362cb923745f89637ab52555826a392a5ec48a85cb7e744df678f2e4d800f5e9f
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUQ:w+156utgpPF8u/7Q

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2612-0-0x000000013FDC0000-0x000000014010D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1960	2612	2024-09-20_92ba57503d63d0c20e62f6e1a973e5d8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2612 wrote to memory of 1960	2612	2024-09-20_92ba57503d63d0c20e62f6e1a973e5d8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2612 wrote to memory of 1960	2612	2024-09-20_92ba57503d63d0c20e62f6e1a973e5d8_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-20_92ba57503d63d0c20e62f6e1a973e5d8_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-20_92ba57503d63d0c20e62f6e1a973e5d8_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2612 -s 72
  2⤵
  PID:1960

memory/2612-0-0x000000013FDC0000-0x000000014010D000-memory.dmp

Filesize
3.3MB

Download