Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 12:04
General
-
Target
2024-09-20_fe1c9836e0f9f68ed7e2ddecd5396a2d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
fe1c9836e0f9f68ed7e2ddecd5396a2d
-
SHA1
3bd2cd10da77f2c7566a384b13ff28fdf8f8f172
-
SHA256
01dea2f1956f8f55454937a07f2cf7dc10d49bada7d9522ab8a4dd98f1cc2c23
-
SHA512
53086537f0a73c7752caddf8de82a071a614478776d871d2239f537300f7a8bdcb35efaec29cd328f32b8db0984dcac2a63d1a7e4ad9818bd44e471fd5238b52
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:T+856utgpPF8u/7c
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_fe1c9836e0f9f68ed7e2ddecd5396a2d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_fe1c9836e0f9f68ed7e2ddecd5396a2d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB