Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 15:50
General
-
Target
2024-11-21_2d2516b8d3e0d8db9db902fe6d7453a1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
2d2516b8d3e0d8db9db902fe6d7453a1
-
SHA1
104301c8ade7b33a4de9265dad029e46a2281a9a
-
SHA256
56ba6ec0a0c4baa6a9d737f21373186ca3acb3064f9fa3531354467469ca06f1
-
SHA512
0d3661f23fbc5bed073e507035a11418e63b8c143e2d050dfc8c14fe1d870862e5224a6081a0ba18034dff9a3236e5befbe0dcd9b025711e900aa3ab296d1683
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnw:r56utgpPFotBER/mQ32lUe
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_2d2516b8d3e0d8db9db902fe6d7453a1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_2d2516b8d3e0d8db9db902fe6d7453a1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery