Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/10/2024, 10:29
Behavioral task
behavioral1
Sample
2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.7MB
-
MD5
4095058f79d722361ffe928d5b82ecbe
-
SHA1
5c4f7287017e217a644a8b7d5f75a6cdb62aa870
-
SHA256
b9df2fa235c8b0e5f3cf9e5ed1fd1ead434743ce81086a08fbb92218e8565f3c
-
SHA512
38882beb800eb7e56050108b438c08eb3eedfd2ebe9373260a1eaa57e42c6299c98d2cd35ebf5023b3036724827c05f62378b9f47ed06ca2307639d635f1bf92
-
SSDEEP
98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUR:w+156utgpPF8u/7R
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 1 IoCs
resource yara_rule behavioral1/memory/2960-0-0x000000013FD80000-0x00000001400CD000-memory.dmp xmrig -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2468 2960 2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe 31 PID 2960 wrote to memory of 2468 2960 2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe 31 PID 2960 wrote to memory of 2468 2960 2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-27_4095058f79d722361ffe928d5b82ecbe_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2960 -s 722⤵PID:2468
-