xmrig | 36fe883920d6d938ade710503a8026552bf43e03e20e8b4a72fc56cc9ad13f6e

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 12:00

Target

2024-09-20_c2a2962da180b0e51d04a1be3de89010_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

c2a2962da180b0e51d04a1be3de89010
SHA1

6ef8c69ebd89a1d9a50c1d92e10f949d994eba45
SHA256

36fe883920d6d938ade710503a8026552bf43e03e20e8b4a72fc56cc9ad13f6e
SHA512

85c8022f266d852ed05976229c741cadf4fc85e96a37bacb9626a5684790a4b101f81e0ebb8239fd6dd4c7aec5bfa7b8f6f4e0381feeb6022a03f0dd096cde29
SSDEEP

98304:hemTLkNdfE0pZrN56utgpPFotBER/mQ32lUQ:w+I56utgpPF8u/7Q

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/1952-0-0x000000013FF50000-0x000000014029D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1932	1952	2024-09-20_c2a2962da180b0e51d04a1be3de89010_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1952 wrote to memory of 1932	1952	2024-09-20_c2a2962da180b0e51d04a1be3de89010_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1952 wrote to memory of 1932	1952	2024-09-20_c2a2962da180b0e51d04a1be3de89010_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-20_c2a2962da180b0e51d04a1be3de89010_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-20_c2a2962da180b0e51d04a1be3de89010_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1952 -s 72
  2⤵
  PID:1932

memory/1952-0-0x000000013FF50000-0x000000014029D000-memory.dmp

Filesize
3.3MB

Download