xmrig | c7e8e84318733a0e6ebd4d4e76b29d265572278bf7f8c3405d4b84072caad651

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/11/2024, 20:52

Target

2024-11-27_ffb3d10709fdb486848aac887dec10f1_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

ffb3d10709fdb486848aac887dec10f1
SHA1

be0bd3ec1dec5dd4d2296a6a51a0cde7f9d576ff
SHA256

c7e8e84318733a0e6ebd4d4e76b29d265572278bf7f8c3405d4b84072caad651
SHA512

63d2912d83fa74a170832d6f90f64d2a2c67c85dddf2bacb56fc1779646032dc4a01fb59d0752e3540c1a636a71044e8b505ff34c3e165a9ce8a5bc2252e2e71
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUP:w+156utgpPF8u/7P

Score

10^/10

xmrig miner

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/1664-0-0x000000013FF30000-0x000000014027D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2340	1664	2024-11-27_ffb3d10709fdb486848aac887dec10f1_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1664 wrote to memory of 2340	1664	2024-11-27_ffb3d10709fdb486848aac887dec10f1_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1664 wrote to memory of 2340	1664	2024-11-27_ffb3d10709fdb486848aac887dec10f1_cobalt-strike_cobaltstrike_poet-rat.exe	32

C:\Users\Admin\AppData\Local\Temp\2024-11-27_ffb3d10709fdb486848aac887dec10f1_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-27_ffb3d10709fdb486848aac887dec10f1_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1664 -s 72
  2⤵
  PID:2340

memory/1664-0-0x000000013FF30000-0x000000014027D000-memory.dmp

Filesize
3.3MB

Download