Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 03:09

General

  • Target

    2024-11-19_b8c5340dc0702d7f05429ac2ced062a2_cobalt-strike_cobaltstrike_poet-rat.exe

  • Size

    5.2MB

  • MD5

    b8c5340dc0702d7f05429ac2ced062a2

  • SHA1

    12f5a1e7af644dc39c68e26818cfa405e074515b

  • SHA256

    a4fab3bc0b3f47a3ff0d7f01b8522c3f947bacee06dad5e17791ea569f0c535c

  • SHA512

    f2e301e6a4adbea90077bcb94024ae79b1ddffb2d46b91aafb0be5100a80871a25c052e559963c3705d9dc2f8dc3f7c0ecccf02be40468360c360d9221aae88f

  • SSDEEP

    49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUQ

Score
10/10

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 15 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-19_b8c5340dc0702d7f05429ac2ced062a2_cobalt-strike_cobaltstrike_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-19_b8c5340dc0702d7f05429ac2ced062a2_cobalt-strike_cobaltstrike_poet-rat.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2820-0-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-1-0x00000000000F0000-0x0000000000100000-memory.dmp

    Filesize

    64KB

  • memory/2820-2-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-3-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-4-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-5-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-6-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-7-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-8-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-9-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-10-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-11-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-12-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-13-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-14-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-15-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB

  • memory/2820-16-0x000000013F980000-0x000000013FCD1000-memory.dmp

    Filesize

    3.3MB