Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 21:47
General
-
Target
2024-12-23_4910254feb8cafb3204494133ce12200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
4910254feb8cafb3204494133ce12200
-
SHA1
c49c74268dc5b26351863d41aa7e4fac3298714d
-
SHA256
4cf6619371e6496c7103784b0c5ad9e7fce4b4a8d7c7461cd3184d1ff99c0ff9
-
SHA512
723fe509158d5234a2555b7d744fed5da57b15f467a0a3881f2e3a0bd4d3f52a09db3f2c1c95dd6558b62b495df1107955794841d5f1bc16b0bbb7dc1d55592f
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnD:r56utgpPFotBER/mQ32lUJ
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-23_4910254feb8cafb3204494133ce12200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-23_4910254feb8cafb3204494133ce12200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery