Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 23:36
General
-
Target
2024-11-23_ff7f5f24c0aeddcfcbd3fac7061ce82a_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
ff7f5f24c0aeddcfcbd3fac7061ce82a
-
SHA1
cd381757b367948093e1ecef595d8702e2653aa2
-
SHA256
97a5e9730d3038ac47227eee933367714a43de10ede9285873d2c600626f3ef4
-
SHA512
f27e19d3003e2beab19c0a711ca14dd3dd3c60fdd40455f1fed38df7ef786c7b7ddebe2ee350a6d9300a599eb447b230e991d3ddb10e99a288df1469a6b7c625
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpn9:r56utgpPFotBER/mQ32lUT
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_ff7f5f24c0aeddcfcbd3fac7061ce82a_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_ff7f5f24c0aeddcfcbd3fac7061ce82a_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery