Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-12-2024 15:43
General
-
Target
2024-12-21_998902622cddc391ca477ec266b90be7_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
998902622cddc391ca477ec266b90be7
-
SHA1
47574fba3d5b0a888f1d8cb0e0fb9f20dd6bb8fb
-
SHA256
c45c6dbb2cb0a0f909406d698fa656545b211f896c7d3cfdb476cbcb42925742
-
SHA512
5d7b2e71b4dd11fd6fba26cf898b7be168159996c557e854f44d07485498848430b901c0bea8da62e3b463272c1b035ed30846d3c2ce64c197336a02e71e6dd7
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnd:r56utgpPFotBER/mQ32lUT
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_998902622cddc391ca477ec266b90be7_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_998902622cddc391ca477ec266b90be7_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery