Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 02:10
General
-
Target
2024-11-19_9e6f8523a88d9a384bce77f19988b6e8_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
9e6f8523a88d9a384bce77f19988b6e8
-
SHA1
a9778fa5bab1346a4d117c992672c4e694d7518a
-
SHA256
3c5b031387b81b3aae5dee40253048d246277481e44973c93111b402943121ee
-
SHA512
f088e0bb306937f270e429b3f0f20aeb1108df73a45bec19b4164857c5c8c65efed266e1e9f0eda973c6958daf16847fd44d66d67e9d701eb0a98a74ed4c3a0f
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnt:r56utgpPFotBER/mQ32lUP
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_9e6f8523a88d9a384bce77f19988b6e8_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_9e6f8523a88d9a384bce77f19988b6e8_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery