xmrig | 702ae45505725f5589b78c76963ec277fbc618c6ca5b778b305a38bfbb8b4f71

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-23_03e4fc0db541e2a679f2102f561dc249_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.2MB
MD5

03e4fc0db541e2a679f2102f561dc249
SHA1

76dc8454eb85e88d4dc97671551a9bc0eb5f69b4
SHA256

702ae45505725f5589b78c76963ec277fbc618c6ca5b778b305a38bfbb8b4f71
SHA512

1d03f69d7bfd4b5474ce011bdda8c389fbcc225c0154e03f81568dfde5ae5fa24bd4fbc5e7fe0af4bd0bbc0d4573dc825c6464f8b2b1c224d69626f71910bee6
SSDEEP

49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral2/memory/3128-3-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-2-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-4-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-5-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-6-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-7-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-8-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-9-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-10-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-11-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-12-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-13-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-14-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-15-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig
behavioral2/memory/3128-16-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	xmrig

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3128-0-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-3-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-2-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-4-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-5-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-6-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-7-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-8-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-9-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-10-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-11-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-12-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-13-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-14-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-15-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx
behavioral2/memory/3128-16-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3128	2024-09-23_03e4fc0db541e2a679f2102f561dc249_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	3128	2024-09-23_03e4fc0db541e2a679f2102f561dc249_cobalt-strike_cobaltstrike_poet-rat.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-23_03e4fc0db541e2a679f2102f561dc249_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-23_03e4fc0db541e2a679f2102f561dc249_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-0-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-1-0x000001C2F5C30000-0x000001C2F5C40000-memory.dmp

Filesize
64KB

Download
memory/3128-3-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-4-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-5-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-6-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-7-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-8-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-9-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-10-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-11-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-12-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-13-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-14-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-15-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download
memory/3128-16-0x00007FF773E80000-0x00007FF7741D1000-memory.dmp

Filesize
3.3MB

Download