Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 01:26
Behavioral task
behavioral1
Sample
2024-11-19_0c25db4ab46669dc71bc5f7135545ccb_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20241010-en
5 signatures
150 seconds
General
-
Target
2024-11-19_0c25db4ab46669dc71bc5f7135545ccb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0c25db4ab46669dc71bc5f7135545ccb
-
SHA1
8b9a82741f15272220c68162212ef17d49412add
-
SHA256
7a34d4b860dba3da4e1e41a2bbf257401f5ade309fb3f28e656778c241c22ca1
-
SHA512
2f0c7a6e451b337bd6c1e5a117a1741789670264a6092808d9645c74b744d1973e19019ab6a20272d6bdd2981421871349f3bc0112203483d0957d893246c29c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral2/memory/1968-2-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-3-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-4-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-5-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-6-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-7-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-8-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-9-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-10-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-11-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-12-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-13-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-14-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-15-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig behavioral2/memory/1968-16-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/1968-0-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-2-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-3-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-4-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-5-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-6-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-7-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-8-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-9-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-10-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-11-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-12-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-13-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-14-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-15-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx behavioral2/memory/1968-16-0x00007FF75D7F0000-0x00007FF75DB41000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1968 2024-11-19_0c25db4ab46669dc71bc5f7135545ccb_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 1968 2024-11-19_0c25db4ab46669dc71bc5f7135545ccb_cobalt-strike_cobaltstrike_poet-rat.exe