Analysis

  • max time kernel
    140s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 03:09

General

  • Target

    2024-11-19_b8c5340dc0702d7f05429ac2ced062a2_cobalt-strike_cobaltstrike_poet-rat.exe

  • Size

    5.2MB

  • MD5

    b8c5340dc0702d7f05429ac2ced062a2

  • SHA1

    12f5a1e7af644dc39c68e26818cfa405e074515b

  • SHA256

    a4fab3bc0b3f47a3ff0d7f01b8522c3f947bacee06dad5e17791ea569f0c535c

  • SHA512

    f2e301e6a4adbea90077bcb94024ae79b1ddffb2d46b91aafb0be5100a80871a25c052e559963c3705d9dc2f8dc3f7c0ecccf02be40468360c360d9221aae88f

  • SSDEEP

    49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUQ

Score
10/10

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 15 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-19_b8c5340dc0702d7f05429ac2ced062a2_cobalt-strike_cobaltstrike_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-19_b8c5340dc0702d7f05429ac2ced062a2_cobalt-strike_cobaltstrike_poet-rat.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2296-0-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-1-0x000001CCD1AB0000-0x000001CCD1AC0000-memory.dmp

    Filesize

    64KB

  • memory/2296-2-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-3-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-4-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-5-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-6-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-7-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-8-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-9-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-10-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-11-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-12-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-13-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-14-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-15-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB

  • memory/2296-16-0x00007FF796910000-0x00007FF796C61000-memory.dmp

    Filesize

    3.3MB