Analysis
-
max time kernel
92s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 16:23
General
-
Target
2024-11-22_154d24bd908e369d0424c82ffe046984_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
154d24bd908e369d0424c82ffe046984
-
SHA1
f2ad89e96eec14e00285c9f02d3d19046840f9a8
-
SHA256
f62f9a82f72eb7a04e90059e4324c0fd0e42b5d32733b5395e5e9777f4a3933d
-
SHA512
dbad3026ab1bc898e7e56b280fc58eef096f76bf00f7b9203fa72aeaeeb63b0a18021821c1f6f1936711235a8a1443823e8c97bc2c1f8a2fa1495c17c3313f7c
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnF:r56utgpPFotBER/mQ32lUD
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-22_154d24bd908e369d0424c82ffe046984_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-22_154d24bd908e369d0424c82ffe046984_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery