xmrig | 16adeef8c6eb17bedaa05a7cdc7dc4b76034228de0cefb2eba8f2040ba54f910

General

Target

2025-01-03_8b62f66b8c9f0786f74b393bce9ae5b1_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.2MB
MD5

8b62f66b8c9f0786f74b393bce9ae5b1
SHA1

1aec491f88efc1e1febcd9ce1d08a5577a5d405c
SHA256

16adeef8c6eb17bedaa05a7cdc7dc4b76034228de0cefb2eba8f2040ba54f910
SHA512

b28fbeaa29a099816dc770cf634453e4c03137018325e17b1556b2e9ed6b774ea490fc254456862cce91edad76acb70925ec95ea79268ab27073cf2c7f035019
SSDEEP

49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBib+56utgpPFotBER/mQ32lUd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2004-2-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-3-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-4-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-5-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-6-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-7-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-8-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-9-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-10-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-11-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-12-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-13-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-14-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-15-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2004-16-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2004-0-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-2-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-3-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-4-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-5-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-6-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-7-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-8-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-9-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-10-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-11-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-12-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-13-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-14-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-15-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2004-16-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2004	2025-01-03_8b62f66b8c9f0786f74b393bce9ae5b1_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2004	2025-01-03_8b62f66b8c9f0786f74b393bce9ae5b1_cobalt-strike_cobaltstrike_poet-rat.exe

C:\Users\Admin\AppData\Local\Temp\2025-01-03_8b62f66b8c9f0786f74b393bce9ae5b1_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-03_8b62f66b8c9f0786f74b393bce9ae5b1_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-0-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-1-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2004-2-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-3-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-4-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-5-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-6-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-7-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-8-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-9-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-10-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-11-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-12-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-13-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-14-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-15-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2004-16-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing