Analysis
-
max time kernel
90s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 13:23
General
-
Target
2024-11-20_5e96cad5f330cad6a6d2af05376e65ac_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
5e96cad5f330cad6a6d2af05376e65ac
-
SHA1
729c68d833a2357244230ccf8fe5f61443a29536
-
SHA256
57b606e97c867c00aa618aa271a966f878e157d5ae3871fafb6883531ab64e32
-
SHA512
4cc00882f45becc0d5a378b75b051d787cbf875aca9b6b8a42c91c7ad79a4ce8c63cfdc69d952c3569acdec10038e331508e981d28b921ac34948fab06223484
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnJ:r56utgpPFotBER/mQ32lU7
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_5e96cad5f330cad6a6d2af05376e65ac_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_5e96cad5f330cad6a6d2af05376e65ac_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery