Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 07:36
General
-
Target
2024-12-30_ef05f10a9b3d2ba4cfd7ecc3f2934e67_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ef05f10a9b3d2ba4cfd7ecc3f2934e67
-
SHA1
0341cf259f986d9b3f387035e8c3e7cdbd076447
-
SHA256
c72005a1f3e11b23d41c4d489896646b5abf06c484f68749fdbaeacf3bc61c6f
-
SHA512
909530c171d348e8ac5db9d69abcc755e116832e81e7bcbdc726a6c54c7d987211a1a68e494efd5710907f9b9fc474ceea59338cd4a2e2e3c74b82f7f133eca1
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibd56utgpPFotBER/mQ32lUu
Score
10/10
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 15 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-30_ef05f10a9b3d2ba4cfd7ecc3f2934e67_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-30_ef05f10a9b3d2ba4cfd7ecc3f2934e67_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB